LoFP

Living off the False Positive is an autogenerated collection of false positives sourced from some of the most popular rule sets. The information is categorized along with ATT&CK techniques, rule source, and data source. Entries include details from related rules along with their description and detection logic.

The goal is to enable both red and blue teams with this information. Red teams can use this information to blend in, whereas blue teams can use this information to assess weak spots in their detection logic. Interestingly, it can also assist during alert triage and investigation, by looking at common FPs around certain techniques and data sources.

To maximize value, don’t scroll – focus on searching for keywords in the false positives themselves (such as “python”, “powershell”, etc.), the techniques, rule source, or data source, then go from there!

A primary goal is to make this maintenance-free, so this data is automatically refreshed nightly.

For more details, checkout the release blog.

If you are struggling with false positive management during rule creation, consider using the Zen of Security Rules.

A project by @br0k3ns0und - br0k3nlab

Title	Tags
\pipe\local\monitorian	t1055 windows sigma
3rd part software application can change the wallpaper. filter is needed.	t1491 endpoint splunk
3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185	t1190 t1210 sigma
3rd party tool may have commandline parameter that can trigger this detection.	t1204 endpoint splunk
3rd party tool may used to changed the wallpaper of the machine	t1491 endpoint splunk
a certain amount of false positives are likely with this detection. msi based installers often trigger for setupapl.dll and vendors will often copy system exectables to a different path for application usage.	t1036 t1036.003 t1218.011 endpoint splunk
a computer account name change event inmediately followed by a kerberos tgt request with matching fields is unsual. however, legitimate behavior may trigger it. filter as needed.	t1078 t1078.002 endpoint splunk
a database instance may be created by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. instances creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	aws elastic
a dlp policy may be removed by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 o365 elastic
a dns lookup does not necessarily mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those ips. b) verify if http, ssl, or tls activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'.	t1496 t1569 t1569.002 zeek sigma
a domain may be transferred to another aws account by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. domain transfers from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1098 aws elastic
a domain transfer lock may be disabled by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. activity from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1098 aws elastic
a elasticache security group deletion may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. security group deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
a elasticache security group may be created by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. security group creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
a file server may experience high-demand loads that could cause this analytic to trigger.	t1021 t1021.002 endpoint splunk
a group may be created by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. group creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1136 aws elastic
a host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.	t1110 T1110.003 endpoint splunk
a host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.	t1110 T1110.003 endpoint splunk
a host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. if this detection triggers on a host other than a domain controller, the behavior could represent a password spraying attack against the host's local accounts.	t1110 T1110.003 endpoint splunk
a host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.	t1110 T1110.003 endpoint splunk
a kms customer managed key may be disabled or scheduled for deletion by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. key deletions by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 aws elastic
a legitimate forwarding rule.	t1140 azure sigma
a legitimate new admin account being created	t1078 t1078.004 azure sigma
a legitimate vba for outlook is usually configured interactively via outlook.exe.	t1137 windows elastic
a log stream may be deleted by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. log stream deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 t1562 aws elastic
a malware filter policy may be deleted by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 o365 elastic
a malware filter rule may be deleted by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 o365 elastic
a mfa device may be deactivated by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. mfa device deactivations from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1531 t1556 aws elastic
a misconfgured network application or firewall may trigger this alert. security scans or test cycles may trigger this alert.	ml elastic
a misconfigured rbac policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors.	kubernetes sigma
a misconfigured service account can trigger this alert. a password change on an account used by an email client can trigger this alert. security test cycles that include brute force or password spraying activities may trigger this alert.	t1110 ml elastic
a network operator or systems administrator may utilize an automated host discovery application that may generate false positives. filter as needed.	t1059 t1059.007 endpoint splunk
a network operator or systems administrator may utilize an automated or manual execution of this firewall rule that may generate false positives. filter as needed.	t1562 t1562.004 endpoint splunk
a network operator or systems administrator may utilize an automated powershell script taht execute .net code that may generate false positive. filter is needed.	t1027 t1027.004 endpoint splunk
a new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this alert. users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this alert.	t1204 t1543 ml elastic
a new child process of zoom isn't malicious by that fact alone. further investigation of the actions of the child process is needed to verify any malicious behavior is taken.	t1068 endpoint splunk
a new cloudshell may be created by a system administrator.	t1059 azure sigma
a new role may be assigned to a management group by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1098 o365 elastic
a new transport rule may be created by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1537 o365 elastic
a newly installed program or one that rarely uses the network could trigger this alert.	ml elastic
a newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert. network activity that occurs rarely, in small quantities, can trigger this alert. possible examples are browsing technical support or vendor networks sparsely. a user who visits a new or unique web destination may trigger this alert.	t1071 ml elastic
a newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this detection rule.	t1552 ml elastic
a newly installed program, or one that runs under a new or rarely used user context, could trigger this detection rule. manual interrogation of the metadata service during debugging or troubleshooting could trigger this rule.	t1552 ml elastic
a non malicious user is unaware of the proper process	t1078 t1078.004 azure sigma
a previously unseen service is not necessarily malicious. verify that the service is legitimate and that was installed by a legitimate process.	t1569 t1569.002 endpoint splunk
a private hosted zone may be asssociated with a vpc by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. if known behavior is causing false positives, it can be exempted from the rule.	t1098 aws elastic
a process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.	t1110 T1110.003 endpoint splunk
a rare hash collision.	t1589 azure sigma
a resource group may be deleted by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. resource group deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1531 aws elastic
a s3 configuration change may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. s3 configuration change from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1537 aws sigma
a safe attachment rule may be disabled by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 o365 elastic
a security group may be created by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. security group creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
a self-hosted runner is automatically removed from github if it has not connected to github actions for more than 14 days.	t1078 t1078.004 t1213 t1213.003 t1526 github sigma
a service principal may be created by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. service principal additions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1550 azure elastic
a service principal name should only be added to an account when an application requires it. while infrequent, this detection may trigger on legitimate actions. filter as needed.	t1098 endpoint splunk
a single port being opened for a new service that is known to be deploying	t1190 aws sigma
a single public ip address servicing multiple legitmate users may trigger this search. in addition, the threshold of 5 distinct users may be too low for your needs. you may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific ip adresses from triggering this search.	t1078 t1078.001 T1110.003 okta tenant splunk
a source ip failing to authenticate with multiple users in a short period of time is not common legitimate behavior.	t1110 T1110.003 T1110.004 t1586 t1586.003 okta tenant o365 tenant splunk
a source ip failing to authenticate with multiple users is not a common for legitimate behavior.	t1110 T1110.003 T1110.004 t1586 t1586.003 azure active directory splunk
a source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. possible false positive scenarios include systems where several users connect to like mail servers, identity providers, remote desktop services, citrix, etc.	t1110 T1110.003 endpoint splunk
a syntax error in mysql also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case.	t1190 sql sigma
a team has configured an ec2 instance to use instance profiles that grant the option for the ec2 instance to talk to other aws services	t1078 t1078.002 aws sigma
a transport rule may be modified by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1537 o365 elastic
a user may generate a shared access link to encryption key files to share with others. it is unlikely that the intended recipient is an external or anonymous user.	t1552 google_workspace elastic
a user may have accidentally entered the wrong credentials during the mfa challenge. if the user is new to mfa, they may have trouble authenticating. ensure that the user is aware of the mfa process and has the correct credentials.	t1078 t1078.004 t1586 t1586.003 t1621 okta tenant splunk
a user may have multiple sessions open at the same time, such as on a mobile device and a laptop.	t1550 okta elastic
a user may report suspicious activity on their okta account in error.	t1078 okta elastic
a user sending emails using personal distribution folders may trigger the event.	t1078 o365 elastic
a user with concurrent sessions from different ips may also represent the legitimate use of more than one device. filter as needed and/or customize the threshold to fit your environment.	t1185 aws account splunk
a user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.	t1110 t1110.001 t1201 aws account azure tenant splunk
a user with successful authentication events from different ips may also represent the legitimate use of more than one device. filter as needed and/or customize the threshold to fit your environment.	t1110 t1110.001 T1110.003 T1535 t1586 azure tenant aws account splunk
a windows administrator may have triggered a low-fidelity credential access alert during a legitimate administrative action. following this, the administrator may have reset the mfa credentials for themselves and then logged into the okta console for ad directory services integration management.	t1556 okta elastic
access attempts to non-existent repositories or due to outdated plugins. usually \"anonymous\" user is reported in the \"author.name\" field in most cases.	t1586 bitbucket sigma
access level modifications may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. access level modifications from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1190 t1526 azure elastic
access to badly maintained internal or development systems	windows sigma
account disabled or blocked in error	t1078 t1078.004 azure sigma
account fallback reasons (after failed login with specific account)	t1110 t1110.001 windows sigma
accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization	t1078 gcp account splunk
actions of a legitimate telnet client	t1548 t1548.002 t1574 t1574.002 windows sigma
active setup installer may add or modify this registry.	t1547 t1547.014 endpoint splunk
actual admin using pim.	t1078 t1078.004 azure sigma
actual failures in lsass.exe that trigger a crash dump (unlikely)	t1003 t1003.001 windows sigma
actual mailbox rules that are moving items based on their workflow.	t1140 azure sigma
actual printing	rpc_firewall sigma
adding new users or groups to the adminsdholder acl is not usual. filter as needed	t1546 endpoint splunk
adding user keys to their own accounts (the filter cannot cover all possible variants of user naming)	t1098 aws sigma
adding users to a specified group may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. user additions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1098 aws elastic
adfind is a command-line tool for ad administration and management that is seen to be leveraged by various adversaries. filter out legitimate administrator usage using the filter macro.	t1018 endpoint splunk
admin activities or installing related updates may do a sudden stop to list of services we monitor.	t1490 endpoint splunk
admin activity	t1033 t1059 t1059.004 t1070 t1070.001 t1136 t1136.001 t1485 t1505 t1505.003 t1546 t1546.001 t1562 t1562.002 t1562.004 windows linux sigma
admin activity (especially in /tmp folders)	t1584 t1587 linux sigma
admin activity (unclear what they do nowadays with finger.exe)	t1105 windows sigma
admin can do changes directly to develop branch	t1199 github splunk
admin can do changes directly to master branch	t1199 github splunk
admin changing date of files.	t1070 t1070.006 linux sigma
admin changing file permissions.	t1222 t1222.002 linux sigma
admin may disable firewall during testing or fixing network problem.	t1562 t1562.001 endpoint splunk
admin may disable problematic schedule task	t1562 t1562.001 endpoint splunk
admin may disable this application for non technical user.	t1112 t1562 t1562.001 endpoint splunk
admin may set this policy for non-critical machine.	t1548 t1548.002 endpoint splunk
admin nslookup usage	t1048 endpoint splunk
admin or power user may used this series of command.	t1087 t1087.002 endpoint splunk
admin or user activity	linux sigma
admin or user activity are expected to generate some false positives	t1546 t1546.004 linux sigma
admin or user may choose to disable this windows features.	t1112 t1562 t1562.001 endpoint splunk
admin or user may choose to disable windows defender product	t1562 t1562.001 endpoint splunk
admin or user may choose to terminate browser via taskkill.exe. filter as needed.	t1562 t1562.001 endpoint splunk
admin or user may choose to use this windows features.	t1562 t1562.001 endpoint splunk
admin or user may choose to use this windows features. filter as needed.	t1562 t1562.001 endpoint splunk
admin or user tool that can terminate multiple process.	t1486 endpoint splunk
admin script	t1120 windows sigma
admin work like legit service installs.	t1543 t1543.002 linux sigma
administration activity	t1558 t1558.003 windows sigma
administration and debugging activity (must be investigated)	windows sigma
administrative activity	t1003 t1016 t1021 t1021.001 t1027 t1036 t1053 t1053.005 t1059 t1059.001 t1059.005 t1071 t1071.001 t1087 t1087.001 t1087.002 t1098 t1105 t1133 t1134 t1136 t1136.001 t1137 t1222 t1222.001 t1505 t1505.004 t1552 t1552.006 t1555 t1555.004 t1562 t1562.001 t1572 t1615 windows linux sigma
administrative activity (adjust code pages according to your organization's region)	t1036 windows sigma
administrative activity that must be investigated	t1098 windows sigma
administrative activity using a remote port forwarding to a local port	t1021 t1021.001 t1021.004 t1572 windows sigma
administrative or software activity	t1105 t1218 t1552 t1552.001 t1564 t1564.004 windows sigma
administrative script libraries	t1027 t1059 t1059.001 t1140 windows sigma
administrative scripts	t1021 t1021.002 t1039 t1048 t1055 t1059 t1059.001 t1059.005 t1137 t1218 t1543 t1543.003 windows sigma
administrative scripts that change the desktop background to a company logo or other image.	t1112 t1491 t1491.001 windows sigma
administrative scripts that download files from the internet	t1071 t1071.001 sigma
administrative scripts that retrieve certain website contents	t1071 t1071.001 sigma
administrative scripts that use the same keywords.	t1047 t1059 t1059.001 windows sigma
administrative tasks on remote services	t1569 t1569.002 rpc_firewall sigma
administrative users will likely use powershell commandlets to troubleshoot and maintain the environment. filter as needed.	t1078 t1078.004 t1586 t1586.003 azure active directory splunk
administrative work	t1003 t1056 t1056.001 linux sigma
administrator actions	t1562 t1562.001 windows sigma
administrator actions (should be investigated)	t1562 t1562.001 windows sigma
administrator actions via the windows defender interface	t1562 t1562.001 windows sigma
administrator activity	t1069 t1069.002 t1087 t1087.002 t1550 t1550.002 windows sigma
administrator activity (must be investigated)	t1562 t1562.001 windows sigma
administrator adding a legitimate temporary access pass	t1078 t1078.004 azure sigma
administrator disabling pim alerts as an active choice.	t1078 azure sigma
administrator interacting with immutable files (e.g. for instance backups).	t1222 t1222.002 linux sigma
administrator may allow inbound traffic in certain network or machine.	t1021 t1021.001 endpoint splunk
administrator may change this registry setting.	t1003.004 endpoint splunk
administrator may change this registry setting. filter as needed.	t1112 endpoint splunk
administrator may disable swapping of devices in a linux host. filter is needed.	t1200 endpoint splunk
administrator may do this commandline for auditing and testing purposes. in this scenario filter is needed.	t1562 t1562.004 endpoint splunk
administrator may execute impersonate wmi object script for auditing. filter is needed.	t1047 endpoint splunk
administrator may execute this app to manage disk	t1070 t1070.004 endpoint splunk
administrator may execute this commandline to trigger shutdown or restart the host machine.	t1529 endpoint splunk
administrator may execute this commandline to trigger shutdown, logoff or restart the host machine.	t1529 endpoint splunk
administrator may execute this commandline tool for auditing purposes. filter as needed.	t1033 endpoint splunk
administrator may have forgotten to review the device.	azure sigma
administrator may legitimately add new owners for service principals. filter as needed.	t1098 azure active directory splunk
administrator may legitimately create service principal. filter as needed.	t1136.003 azure active directory splunk
administrator may legitimately invite external guest users. filter as needed.	t1136.003 o365 tenant azure active directory splunk
administrator may modify or delete firewall configuration.	t1562 t1562.004 endpoint splunk
administrator may use choice.exe to allow user to choose from and indexes of choices from a batch script.	t1497 T1497.003 endpoint splunk
administrator might leverage the same command line for debugging or other purposes. however this action must be always investigated	t1562 t1562.001 windows sigma
administrator might try to disable defender features during testing (must be investigated)	t1562 t1562.001 windows sigma
administrator or administrator scripts might delete packages for several reasons (debugging, troubleshooting).	t1070 linux sigma
administrator or administrator scripts might leverage the flags mentioned in the detection section. either way, it should always be monitored	t1562 t1562.002 windows sigma
administrator or backup activity	t1562 t1562.002 windows sigma
administrator or it professional may execute this application for verifying files or debugging application.	t1036 endpoint splunk
administrator or network operator can create file in ~/.ssh folders for automation purposes. please update the filter macros to remove false positives.	t1098 T1098.004 endpoint splunk
administrator or network operator can create file in crontab folders for automation purposes. please update the filter macros to remove false positives.	t1053 t1053.003 endpoint splunk
administrator or network operator can create file in profile.d folders for automation purposes. please update the filter macros to remove false positives.	t1546 t1546.004 endpoint splunk
administrator or network operator can create file in this folders for automation purposes. please update the filter macros to remove false positives.	t1037 T1037.004 t1547 t1547.006 endpoint splunk
administrator or network operator can create this file for automation purposes. please update the filter macros to remove false positives.	t1053 t1053.003 endpoint splunk
administrator or network operator can execute this command. please update the filter macros to remove false positives.	t1003 T1003.008 t1016 t1070 t1070.004 t1136 t1136.001 t1222 t1222.002 t1485 t1547 t1547.006 t1548 t1548.001 t1548.003 t1574 t1574.006 endpoint splunk
administrator or network operator can use this application for automation purposes. please update the filter macros to remove false positives.	t1016 t1030 t1033 t1053 t1053.002 t1053.003 t1083 t1136 t1136.001 t1140 t1222 t1222.002 t1485 t1489 t1546 t1546.004 t1547 t1547.006 t1552 t1552.004 t1555 t1555.005 t1562 t1562.004 t1569 t1569.002 t1574 t1574.006 endpoint splunk
administrator or network operator can use this commandline for automation purposes. please update the filter macros to remove false positives.	t1053 t1053.002 t1053.003 T1053.006 t1098 T1098.004 t1546 t1546.004 endpoint splunk
administrator or network operator may execute this command. please update the filter macros to remove false positives.	t1497 T1497.003 endpoint splunk
administrator powershell scripts	t1078 t1197 windows sigma
administrator roles could be assigned to users or group by other admin users.	t1098 t1098.003 okta sigma
administrator roles may be assigned to okta users by a super admin user. verify that the behavior was expected. exceptions can be added to this rule to filter expected behavior.	t1098 okta elastic
administrator script	t1059 t1059.001 t1069 t1069.001 windows sigma
administrator scripts	t1059 t1059.001 windows sigma
administrator scripts or activity.	t1562 t1562.004 windows sigma
administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.	t1110 t1110.001 t1586 t1586.003 aws account splunk
administrator typo might cause some false positives	t1218 t1218.010 windows sigma
administrator, hotline ask to user	t1016 windows sigma
administrators	t1021 t1021.002 windows sigma
administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. these attempts will be detected by the search.	t1114 t1114.001 endpoint splunk
administrators backup scripts (must be investigated)	windows sigma
administrators building packages using iexpress.exe	t1218 windows sigma
administrators can create memory dumps for debugging purposes, but memory dumps of the lsass process would be unusual.	t1003 t1003.001 windows splunk
administrators can leverage psexec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. however, it is not likely that you'd see multiple occurrences of this event on a machine	t1021 t1021.002 endpoint splunk
administrators closing unused ports to reduce the attack surface	t1190 aws sigma
administrators configuring new users.	t1087 t1087.002 windows sigma
administrators debugging servers	t1082 windows splunk
administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.	t1580 aws sigma
administrators may add external users to groups to share files and communication with them via the intended recipient be the group they are added to. it is unlikely an external user account would be added to an organization's group where administrators should create a new user account.	t1078 google_workspace elastic
administrators may allow creation of script or exe in the paths specified. filter as needed.	t1036 t1091 endpoint splunk
administrators may allow creation of script or exe in this path.	t1204 t1204.002 t1547 t1547.001 endpoint splunk
administrators may allow execution of specific binaries in non-standard paths. filter as needed.	t1543 endpoint splunk
administrators may attempt to change the default execution policy on a system for a variety of reasons. however, setting the policy to \"unrestricted\" or \"bypass\" as this search is designed to identify, would be unusual. hits should be reviewed and investigated as appropriate.	t1059 t1059.001 endpoint splunk
administrators may create custom email routes in google workspace based on organizational policies, administrative preference or for security purposes regarding spam.	t1114 google_workspace elastic
administrators may create scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users.	t1053 t1053.002 endpoint splunk
administrators may create vbs or js script that use several tool as part of its execution. filter as needed.	t1055 t1134 t1134.004 t1543 endpoint splunk
administrators may create windows services on remote systems, but this activity is usually limited to a small set of hosts or users.	t1543 t1543.003 endpoint splunk
administrators may enable or disable this feature that may cause some false positive.	t1021 t1021.001 t1112 t1219 endpoint splunk
administrators may execute this command for testing or auditing.	t1047 endpoint splunk
administrators may execute this command that may cause some false positive. filter as needed.	t1112 endpoint splunk
administrators may execute this powershell command to get hardware information related to camera on $dest$.	t1592 T1592.001 endpoint splunk
administrators may legitimately access, delete, and replace objects in s3 buckets. ensure that the sequence of events is not part of a legitimate operation before taking action.	t1485 aws elastic
administrators may legitimately add security group rules to allow traffic from any ip address or from specific ip addresses to common remote access ports.	t1562 aws elastic
administrators may legitimately assign the application administrator role to a user. filter as needed.	t1098 t1098.003 azure active directory splunk
administrators may legitimately assign the global administrator role to a user. filter as needed.	t1098.003 azure active directory splunk
administrators may legitimately assign the privileged authentication administrator role as part of administrative tasks. filter as needed.	t1003.002 azure active directory splunk
administrators may legitimately assign the privileged roles to service principals as part of administrative tasks. filter as needed.	t1098 t1098.003 azure active directory o365 tenant splunk
administrators may legitimately create azure automation accounts. filter as needed.	t1136 t1136.003 azure tenant splunk
administrators may legitimately create azure automation runbooks. filter as needed.	t1136 t1136.003 azure tenant splunk
administrators may legitimately create azure runbook webhooks. filter as needed.	t1078 t1078.004 azure tenant splunk
administrators may legitimately use applocker to allow applications.	t1218 endpoint splunk
administrators may leverage dcom to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.	t1021 t1021.003 endpoint splunk
administrators may leverage findstr to find passwords in gpo to validate exposure. filter as needed.	t1552 t1552.006 endpoint splunk
administrators may leverage powersploit tools for legitimate reasons, filter as needed.	t1087 t1087.002 endpoint splunk
administrators may leverage powerview for legitimate purposes, filter as needed.	t1069 t1078.002 t1087 t1087.001 t1087.002 endpoint splunk
administrators may leverage winrm and `enter-pssession` for administrative and troubleshooting tasks. this activity is usually limited to a small set of hosts or users. in certain environments, tuning may not be possible.	t1021 t1021.006 endpoint splunk
administrators may leverage winrm and `invoke-command` to start a process on remote systems for system administration or automation use cases. this activity is usually limited to a small set of hosts or users. in certain environments, tuning may not be possible.	t1021 t1021.006 endpoint splunk
administrators may leverage winrm and winrs to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.	t1021 t1021.006 endpoint splunk
administrators may leverage wwmi and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.	t1047 endpoint splunk
administrators may modify the boot configuration ignore failure during testing and debugging.	t1490 endpoint splunk
administrators may modify the boot configuration.	t1490 endpoint splunk
administrators may remove 2-step verification (2sv) temporarily for testing or during maintenance. if 2sv was previously enabled, it is not common to disable this policy for extended periods of time.	t1556 google_workspace elastic
administrators may start scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users.	t1053 t1053.005 endpoint splunk
administrators may start windows services on remote systems, but this activity is usually limited to a small set of hosts or users.	t1543 t1543.003 endpoint splunk
administrators may temporarily disabled bitlocker on managed devices for maintenance, testing or to resolve potential endpoint conflicts.	t1562 google_workspace elastic
administrators may transfer file ownership during employee leave or absence to ensure continued operations by a new or existing employee.	t1074 google_workspace elastic
administrators may upload ssh public keys to ec2 instances for legitimate purposes.	t1098 aws elastic
administrators may use ec2 instances to interact with iam services as part of an automation workflow, ensure validity of the triggered event and include exceptions where necessary.	t1078 t1098 rules_building_block elastic
administrators may use nltest for troubleshooting purposes, otherwise, rarely used.	t1482 endpoint splunk
administrators may use the command prompt for regular administrative tasks. it's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool.	t1059 t1105 windows elastic
administrators may use the tasklist command to display a list of currently running processes. by itself, it does not indicate malicious activity. after obtaining a foothold, it's possible adversaries may use discovery commands like tasklist to get information about running processes.	t1057 _deprecated elastic
administrators may use this command. filter as needed.	t1222 endpoint splunk
administrators may use this legitimately to gather info from remote systems. filter as needed.	t1047 endpoint splunk
administrators might alter features for troubleshooting, performance reasons, or other administrative tasks. filter as needed.	t1562 t1562.001 T1562.008 o365 tenant splunk
administrators might rename livekd before its usage which could trigger this. add additional names you use to the filter	windows sigma
administrators might temporarily disable the advanced audit for troubleshooting, performance reasons, or other administrative tasks. filter as needed.	t1562 T1562.008 o365 tenant splunk
administrators might temporarily share a mailbox with all users for legitimate reasons, such as troubleshooting, migrations, or other administrative tasks. some organizations use shared mailboxes for teams or departments where multiple users need access to the same mailbox. filter as needed.	t1114 T1114.002 o365 tenant splunk
administrators often leverage net.exe to create admin accounts.	t1136 t1136.001 endpoint splunk
administrators often leverage net.exe to create or delete network shares. you should verify that the activity was intentional and is legitimate.	t1070 t1070.005 endpoint splunk
administrators or administrative scripts may use this application. filter as needed.	t1222 endpoint splunk
administrators or automated systems may legitimately perform multiple `describe` and `list` api calls in a short time frame. verify the user identity and the purpose of the api calls to determine if the behavior is expected.	t1580 aws elastic
administrators or developers might enable this for testing purposes or to install custom private packages	windows sigma
administrators or installed processes that leverage nohup	t1059 t1059.004 linux sigma
administrators or power users may leverage powerview for system management or troubleshooting.	t1018 endpoint splunk
administrators or power users may remove their shares via cmd line	t1070 t1070.005 windows sigma
administrators or power users may use adsisearcher for troubleshooting.	t1018 t1069 t1069.002 endpoint splunk
administrators or power users may use powerview for troubleshooting	t1558 T1558.004 endpoint splunk
administrators or power users may use search for accounts with kerberos pre authentication disabled for legitimate purposes.	t1558 T1558.004 endpoint splunk
administrators or power users may use this command for troubleshooting.	t1018 t1033 t1049 t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1201 endpoint splunk
administrators or power users may use this command for troubleshooting. filter as needed.	t1033 t1057 endpoint splunk
administrators or power users may use this powershell commandlet for troubleshooting.	t1018 t1033 t1049 t1059 t1059.001 t1069 t1069.002 t1087 t1087.001 endpoint splunk
administrators or power users may use this powerview for troubleshooting.	t1069 t1069.002 endpoint splunk
administrators or power users may use this powerview functions for troubleshooting.	t1069 t1069.002 endpoint splunk
administrators or tools shutting down the services due to upgrade or removal purposes. if you experience some false positive, please consider adding filters to the parent process launching this command and not removing the entry	t1489 windows sigma
administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)	t1588 t1588.002 windows sigma
administrators that have renamed megasync	t1218 windows sigma
administrators that submit known phishing training exercises.	t1566 t1566.001 t1566.002 o365 tenant splunk
administrators that use the runas command or scheduled tasks	t1078 windows sigma
administrators using plutil to change plist files.	T1647 endpoint splunk
administrators using the diskshadow tool in their infrastructure as a main backup tool with scripts will cause false positives that can be filtered with `windows_diskshadow_proxy_execution_filter`	t1218 endpoint splunk
administrators using the dism tool to update and install windows features may cause false positives that can be filtered with `windows_dism_install_powershell_web_access_filter`.	t1548.002 endpoint splunk
administrators who rename binaries (should be investigated).	t1036 t1036.003 windows sigma
administrators will legitimately assign the privileged roles users as part of administrative tasks. filter as needed.	t1098 t1098.003 azure active directory splunk
administrators within an aws organization structure may legitimately encrypt bucket objects with a key from an account different from the target bucket. ensure that this behavior is not part of a legitimate operation before taking action.	t1486 aws elastic
administrators within an aws organization structure may legitimately suspend object versioning. ensure that this behavior is not part of a legitimate operation before taking action.	t1490 aws elastic
administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. filter as needed.	t1059 endpoint splunk
admins may setup new or modify old spans, or use a monitor for troubleshooting	t1040 cisco sigma
admins that use psexec or paexec to escalate to the system account for maintenance purposes (rare)	t1587 t1587.001 windows sigma
adws is used by a number of legitimate applications that need to interact with active directory. these applications should be added to the allow-listing to avoid false positives.	t1087 windows sigma
after a new ami is created, the first systems created with that ami will cause this alert to fire. verify that the ami being used was created by a legitimate user.	aws instance splunk
after a new image is created, the first systems created with that image will cause this alert to fire. verify that the image being used was created by a legitimate user.	cloud compute instance splunk
alerts on legitimate printer drivers that do not set any more details in the manufacturer value	t1574 windows sigma
all kind of software downloads	t1203 t1204 t1204.002 t1566 sigma
all kinds of software downloads	t1203 t1204 t1204.002 t1566 sigma
allowed administrative activities.	t1020 t1078 t1078.004 t1537 t1562 t1562.001 github sigma
allowed self-hosted runners changes in the environment.	t1078 t1078.004 t1213 t1213.003 t1526 github sigma
alse positives may be present based on automated tooling or system administrators. filter as needed.	t1537 aws account splunk
although highly unlikely, legitimate applications may use the same command line parameters as mimikatz.	t1550 t1550.003 endpoint splunk
although it is recommended to not have rdp exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. work to secure the server if you are unable to remove it from being exposed to the internet.	t1021 t1021.001 zeek sigma
although not recommended, certain users may be exempt from multi-factor authentication. adjust the filter as necessary.	t1078 t1078.004 t1586 t1586.003 t1621 okta tenant splunk
although not recommended, certain users may be required without multi-factor authentication. filter as needed	t1078 t1078.004 t1586 t1586.003 azure active directory google cloud platform tenant splunk
although uncommon, administrators may leverage impackets tools to start a process on remote systems for system administration or automation use cases.	t1021 t1021.002 t1021.003 t1047 t1543.003 endpoint splunk
although uncommon, legitimate applications may create and delete a scheduled task within 30 seconds. filter as needed.	t1053.005 endpoint splunk
although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed.	t1218 t1218.001 endpoint splunk
although unlikely, administrators may need to set this flag for legitimate purposes.	t1558 T1558.004 endpoint splunk
although unlikely, administrators may use event subscriptions for legitimate purposes.	t1047 t1546 t1546.003 endpoint splunk
although unlikely, administrators may use wmi to execute commands for legitimate purposes.	t1047 endpoint splunk
although unlikely, administrators may use wmi to launch scripts for legitimate purposes. filter as needed.	t1047 endpoint splunk
although unlikely, legitimate applications may use the same command line parameters as rubeus. filter as needed.	t1550 t1550.003 t1558 t1558.003 T1558.004 endpoint splunk
although unlikely, limited instances have been identified coming from native microsoft utilities similar to sccm.	t1127 endpoint splunk
although unlikely, limited instances of regasm.exe or may cause a false positive. filter based endpoint usage, command line arguments, or process lineage.	t1218 t1218.009 endpoint splunk
although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. filter based endpoint usage, command line arguments, or process lineage.	t1218 t1218.009 endpoint splunk
although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. filter based endpoint usage, command line arguments, or process lineage.	t1218 t1218.009 endpoint splunk
although unlikely, limited instances of regsvcs.exe may cause a false positive. filter based endpoint usage, command line arguments, or process lineage.	t1218 t1218.009 endpoint splunk
although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. filter as needed.	t1218 t1218.001 endpoint splunk
although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.	t1127 t1127.001 t1218 t1218.005 endpoint splunk
although unlikely, some legitimate applications may retrieve a chm remotely, filter as needed.	t1218 t1218.001 endpoint splunk
although unlikely, some legitimate applications may use a moved copy of microsoft.workflow.compiler.exe, triggering a false positive.	t1036 t1036.003 t1127 endpoint splunk
although unlikely, some legitimate applications may use a moved copy of msbuild, triggering a false positive.	t1036 t1036.003 t1127 t1127.001 endpoint splunk
although unlikely, some legitimate applications may use a moved copy of mshta.exe, but never renamed, triggering a false positive.	t1218 t1218.005 endpoint splunk
although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.	t1036 t1036.003 t1218 t1218.011 endpoint splunk
although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive.	t1218 t1218.011 endpoint splunk
although unlikely, some legitimate applications may use setupapi triggering a false positive.	t1218 t1218.011 endpoint splunk
although unlikely, some legitimate applications may use start as a function and call it via the command line. filter as needed.	t1218 t1218.011 endpoint splunk
although unlikely, some legitimate applications may use syssetup.dll, triggering a false positive.	t1218 t1218.011 endpoint splunk
although unlikely, some legitimate third party applications may use a moved copy of dllhost, triggering a false positive.	t1055 endpoint splunk
although unusual, users who have lost their passwords may trigger this detection. filter as needed.	t1110 t1110.001 o365 tenant splunk
amazon ssm document worker	t1027 t1059 t1059.001 windows sigma
ami sharing is a common practice in aws environments. ensure that the sharing is authorized before taking action.	t1537 aws elastic
an administrator may need to attach a hostpath volume for a legitimate reason. this alert should be investigated for legitimacy by determining if the kuberenetes.audit.requestobject.spec.volumes.hostpath.path triggered is one needed by its target container/pod. for example, when the fleet managed elastic agent is deployed as a daemonset it creates several hostpath volume mounts, some of which are sensitive host directories like /proc, /etc/kubernetes, and /var/log. add exceptions for trusted container images using the query field \"kubernetes.audit.requestobject.spec.container.image\"	T1610 t1611 kubernetes elastic
an administrator may need to exec into a pod for a legitimate reason like debugging purposes. containers built from linux and windows os images, tend to include debugging utilities. in this case, an admin may choose to run commands inside a specific container with kubectl exec ${pod_name} -c ${container_name} -- ${cmd} ${arg1} ${arg2} ... ${argn}. for example, the following command can be used to look at logs from a running cassandra pod: kubectl exec cassandra --cat /var/log/cassandra/system.log . additionally, the -i and -t arguments might be used to run a shell connected to the terminal: kubectl exec -i -t cassandra -- sh	t1059 t1609 cloud_defend kubernetes elastic
an administrator may submit this request as an \"impersonateduser\" to determine what privileges a particular service account has been granted. however, an adversary may utilize the same technique as a means to determine the privileges of another token other than that of the compromised account.	T1613 kubernetes elastic
an administrator or developer may want to use a pod that runs as root and shares the hosts ipc, network, and pid namespaces for debugging purposes. if something is going wrong in the cluster and there is no easy way to ssh onto the host nodes directly, a privileged pod of this nature can be useful for viewing things like iptable rules and network namespaces from the host's perspective. add exceptions for trusted container images using the query field \"kubernetes.audit.requestobject.spec.container.image\"	T1610 t1611 kubernetes elastic
an anti-phishing policy may be deleted by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1566 o365 elastic
an anti-phishing rule may be deleted by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1566 o365 elastic
an ephemeral self-hosted runner is automatically removed from github if it has not connected to github actions for more than 1 day.	t1078 t1078.004 t1213 t1213.003 t1526 github sigma
an ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.	t1110 T1110.003 T1110.004 aws account splunk
an okta admnistrator may be logged into multiple accounts from the same host for legitimate reasons.	t1110 okta elastic
an rds security group deletion may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. security group deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1531 aws elastic
an rds security group may be created by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. security group creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1136 aws elastic
an single endpoint accessing windows administrative shares across a large number of endpoints is not common behavior. possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.	t1135 endpoint splunk
an single endpoint authenticating to a large number of hosts is not common behavior. possible false positive scenarios include but are not limited to vulnerability scanners, jump servers and missconfigured systems.	t1078 endpoint splunk
an single endpoint requesting a large number of computer service tickets is not common behavior. possible false positive scenarios include but are not limited to vulnerability scanners, administration systeams and missconfigured systems.	t1078 endpoint splunk
an single endpoint requesting a large number of kerberos service tickets is not common behavior. possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.	t1078 t1135 t1558 t1558.003 endpoint splunk
an unknown bug seems to trigger the windows \"svchost\" process to drop evtx files in the \"c:\windows\temp\" directory in the form \"<log_name\">_<uuid>.evtx\". see https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files	t1562 t1562.002 windows sigma
analyst testing	t1071 t1071.001 sigma
anonymous access to the api server is a dangerous setting enabled by default. common anonymous connections (e.g., health checks) have been excluded from this rule. all other instances of authorized anonymous requests should be investigated.	t1078 kubernetes elastic
another service that uses a single -s command line switch	t1003 t1003.001 windows sigma
another tool that uses command line flags similar to procdump	t1003 t1003.001 t1036 windows sigma
another tool that uses the command line switches of ngrok	t1572 windows sigma
another tool that uses the command line switches of psloglist	t1087 t1087.001 t1087.002 windows sigma
another tool that uses the command line switches of xordump	t1003 t1003.001 t1036 windows sigma
ansible	t1027 t1027.004 windows sigma
anti virus products	t1548 t1548.002 windows sigma
anti-virus	t1134 t1134.001 windows sigma
antivirus and other third party products are known to trigger this rule quite a lot. initial filters and tuning is required before using this rule.	windows sigma
antivirus products	t1003 t1003.001 windows sigma
antivirus, anti-spyware, anti-malware software	t1003 windows sigma
any legitimate cron file.	t1053 t1053.003 linux sigma
any powershell script that creates bat files	t1574 t1574.001 windows sigma
any user deleting files that way.	t1485 linux sigma
app-v clients	t1218 windows sigma
appending null bytes to files.	t1485 linux sigma
application being deleted may be performed by a system administrator.	t1489 azure sigma
application being removed may be performed by a system administrator.	gcp sigma
application bugs	t1190 jvm python spring velocity django ruby_on_rails sigma
application credential added from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
application credential added may be performed by a system administrator.	azure sigma
application credential additions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. application credential additions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1550 azure elastic
application deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1489 azure sigma
application gateway being modified or deleted may be performed by a system administrator.	azure sigma
application gateway modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
application installers might contain scripts as part of the installation process.	t1059 t1059.002 macos sigma
application owners may be added for legitimate reasons, filter as needed.	t1098 o365 tenant splunk
application security group being modified or deleted may be performed by a system administrator.	azure sigma
application security group modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
applications can be added and removed from blocklists by google workspace administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 google_workspace elastic
applications can be added to a google workspace domain by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	google_workspace elastic
applications could use this notation occasionally which might generate some false positives. in that case investigate the parent and child process.	t1564 t1564.004 windows sigma
applications for password management.	t1555 macos elastic
applications integrated with aws might assume roles to access aws resources.	t1548 t1550 aws elastic
applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow	t1078 azure sigma
applications that are input constrained will need to use device code flow and are valid authentications.	t1078 azure sigma
applications that deal with non-domain joined authentications. recommend adjusting the upperbound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.	t1110 T1110.003 endpoint splunk
applications that load the same dlls mentioned in the detection section. investigate them and filter them out if a lot fps are caused.	t1574 t1574.001 t1574.002 windows sigma
approved activity performed by an administrator.	t1098 t1098.005 azure sigma
approved administrator/owner activities.	t1556 github sigma
approved changes by the organization owner. please validate the 'actor' if authorized to make the changes.	t1195 t1195.001 github sigma
approved installs of windows sdk with debugging tools for windows (windbg).	t1127 windows sigma
approved third-party applications that use google drive download urls.	t1105 cross-platform elastic
appvclient	t1047 t1059 t1059.001 windows sigma
as is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamoluous behavior.	account splunk
as part of legitimate administrative behavior, users may activate pim roles. filter as needed	t1098 t1098.003 azure active directory splunk
as part of legitimate administrative behavior, users may be assigned pim roles. filter as needed	t1098 t1098.003 azure active directory splunk
as the \"selection_cmdlet\" is common in scripts the matching engine might slow down the search. change into regex or a more accurate string to avoid heavy resource consumption if experienced	t1518 t1518.001 windows sigma
as the script block is a blob of text. false positive may occur with scripts that contain the keyword as a reference or simply use it for detection.	t1046 t1082 t1106 t1518 t1548 t1548.002 t1552 t1552.001 t1555 t1555.003 windows sigma
as this is a general purpose rule, legitimate usage of the encode functionality will trigger some false positives. apply additional filters accordingly	t1027 windows sigma
as this is controlled by group policy as well as user settings. some false positives may occur.	windows sigma
assignment of rights to a service account.	t1098 o365 elastic
assumed roles may be used by legitimate automated systems to create iam users for specific workflows. verify if this event aligns with known automation activities. if the action is routine for specific roles or user agents (e.g., `aws-cli`, `boto3`), consider adding those roles or user agents to a monitored exception list for streamlined review.	t1136 aws elastic
assumerole from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1548 t1550 t1550.001 aws sigma
assumerole may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	t1548 t1550 t1550.001 aws sigma
at this stage, there are no known false positives. during testing, no process events refering the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. therefore, it can be asumed that any occurences of this in the process events would be worth investigating. in the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list.	endpoint splunk
attach to policy can create a lot of noise. this search can be adjusted to provide specific values to identify cases of abuse (i.e status=failure). the search can provide context for common users attaching themselves to higher privilege policies or even newly created policies.	t1078 aws account splunk
attacks using a golden saml or saml assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source ip sourceipaddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks.	t1078 aws federated account splunk
authorization rule additions or modifications may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. authorization rule additions or modifications from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	T1530 t1537 azure elastic
authorized administrative activity	t1087 t1087.002 windows sigma
authorized changes to the aws account's identity provider	t1556 aws sigma
authorized heavy usage of the system that is business justified and monitored.	aws_bedrock elastic
authorized modification by administrators	t1556 azure sigma
authorized softwareupdate settings changes	t1562 macos elastic
authorized third party network logon providers.	t1543 t1556 windows elastic
auto updates of windows defender causes restarts	t1562 t1562.001 windows sigma
automated processes for infrastructure setup may trigger this alert.	t1078 aws sigma
automated processes may need to take these actions and may need to be filtered.	t1078 t1552 t1552.007 kubernetes sigma
automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.	t1110 okta aws o365 elastic
automated processes that uses terraform may lead to false positives.	t1078 t1548 t1550 t1550.001 aws sigma
automated processes using tools like terraform may trigger this alert.	t1078 t1078.004 t1531 aws sigma
automated tools such as jenkins may encode or decode files as part of their normal behavior. these events can be filtered by the process executable or username values.	t1027 t1140 _deprecated linux elastic
automated workflows might assume roles to perform periodic tasks such as data backups, updates, or deployments.	t1548 t1550 aws elastic
automated workflows might assume root to perform periodic administrative tasks.	t1098 t1548 aws elastic
automation account has been blocked or disabled	t1078 t1078.004 azure sigma
automation scripting language may used by network operator to do ldap query.	t1059 t1059.007 endpoint splunk
av signature updates	t1003 t1003.001 t1003.002 t1003.004 t1003.006 windows sigma
aws administrator legitimately disabling bucket versioning	t1490 aws sigma
aws administrators may disable mfa but it is highly unlikely for this event to occur without prior notice to the company	t1556 t1556.006 t1586 t1586.003 t1621 aws account splunk
aws administrators or automated processes might regularly assume roles for legitimate administrative purposes.	t1548 t1550 aws elastic
aws administrators or automated processes might regularly assume root for legitimate administrative purposes.	t1098 t1548 aws elastic
aws api keys legitimate exchange workflows	t1098 aws sigma
aws iam roles anywhere trust anchors are legitimate profiles that can be created by administrators to allow access from any location. ensure that the trust anchor is created by a legitimate administrator and that the external certificate authority is authorized.	t1098 aws elastic
aws roles anywhere profiles are legitimate profiles that can be created by administrators to allow access from any location. ensure that the profile created is expected and that the trust policy is configured securely.	t1098 aws elastic
aws services might assume roles to access aws resources as part of their standard operations.	t1548 t1550 aws elastic
aws services might assume root to access aws resources as part of their standard operations.	t1098 t1548 aws elastic
aws tasks that require aws account root user credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html	t1078 t1078.004 aws sigma
azure ad connect syncing operations.	t1003 t1003.006 endpoint splunk
azure front web application firewall (waf) policy deletions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. azure front web application firewall (waf) policy deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 azure elastic
azure kubernetes admissions controller may be done by a system administrator.	t1078 t1552 t1552.007 azure sigma
azure kubernetes cronjob/job may be done by a system administrator.	t1053 t1053.003 azure sigma
backup scenarios using the commandline	t1490 windows sigma
backup software	t1003 t1486 windows sigma
bad connections or network interruptions	t1210 windows sigma
based on microsoft documentation, legacy systems or applications will use rc4-hmac as the default encryption for kerberos service ticket requests. specifically, systems before windows server 2008 and windows vista. newer systems will use aes128 or aes256.	t1558 T1558.001 endpoint splunk
based on safe links policies, may vary.	t1566 t1566.001 o365 tenant splunk
based on the high-frequency threshold, it would be unlikely for a legitimate user to exceed the threshold for failed totp code attempts in a short time-span.	t1110 azure elastic
based on the values of`datapointthreshold` and `deviationthreshold`, the false positive rate may vary. please modify this according the your environment.	t1078.004 T1530 aws instance s3 bucket splunk
baseline your environment before production. it is possible build systems using iis will spawn cmd.exe to perform a software build. filter as needed.	t1505 t1505.003 endpoint splunk
be aware of potential false positives - legitimate applications may cause benign activities to be flagged.	t1553.003 endpoint splunk
be aware of potential false positives - legitimate uses of the /webauth_operation.php endpoint may cause benign activities to be flagged.the url in the analytic is specific to a successful attempt to exploit the vulnerability. review contents of the http body to determine if the request is malicious. if the request is benign, add the url to the whitelist or continue to monitor.	t1059 t1105 t1190 web server splunk
be aware of potential false positives - legitimate uses of winrar and the listed processes in your environment may cause benign activities to be flagged. upon triage, review the destination, user, parent process, and process name involved in the flagged activity. capture and inspect any relevant on-disk artifacts, and look for concurrent processes to identify the attack source. this approach helps analysts detect potential threats earlier and mitigate the risks.	t1105 endpoint splunk
bear in mind, administrators debugging scheduled task entries may trigger this analytic, necessitating fine-tuning and filtering to distinguish between legitimate and potentially malicious use of 'schtasks.exe'.	t1053 endpoint splunk
because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. however, if there are other correlating events, it may warrant further investigation.	t1546 t1546.011 endpoint splunk
because the recycle bin is a hidden folder in modern versions of windows, it would be unusual for a process other than explorer.exe to write to it. incidents should be investigated as appropriate.	t1036 windows splunk
because these extensions are not typically used in normal operations, you should investigate all results.	endpoint splunk
because these ports are in the ephemeral range, this rule may false under certain conditions such as when a nated web server replies to a client which has used a port in the range by coincidence. in this case, such servers can be excluded if desired. some cloud environments may use this port when vpns or direct connects are not in use and database instances are accessed directly across the internet.	_deprecated elastic
because this port is in the ephemeral range, this rule may false under certain conditions, such as when a nated web server replies to a client which has used a port in the range by coincidence. in this case, such servers can be excluded. some applications may use this port but this is very uncommon and usually appears in local traffic using private ips, which this rule does not match. some cloud environments, particularly development environments, may use this port when vpns or direct connects are not in use and cloud instances are accessed across the internet.	_deprecated elastic
benign administrative tasks can also trigger alerts, necessitating a firm understanding of the typical system behavior and precise tuning of the analytic to reduce false positives.	t1053.005 t1059 t1059.001 endpoint splunk
benign changes to a db instance	t1020 aws sigma
benign files can trigger signatures in the built-in virus protection	T1080 o365 elastic
benign scheduled tasks creations or executions that happen often during software installations	t1053 t1053.005 windows sigma
better use event ids for user creation rather than command line rules.	t1136 t1136.001 windows sigma
blob permissions may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1222 azure elastic
bucket components may be deleted by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. bucket component deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1070 aws elastic
bucket components may be deleted or adjusted by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. bucket component deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1070 aws elastic
bucket logging may be disabled by a system or network administrator. verify whether the user identity and/or user agent should be making changes in your environment. bucket component deletions by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
bucket replication accross accounts is a legitimate practice in some aws environments. ensure that the sharing is authorized before taking action.	t1537 aws elastic
build servers and ci systems can sometimes trigger this alert. security test cycles that include brute force or password spraying activities may trigger this alert.	t1078 t1110 ml elastic
build systems, like jenkins, may start processes in the `/tmp` directory. these can be exempted by name or by username.	_deprecated elastic
business approved changes by known administrators.	t1098 t1098.003 t1136.003 T1484.002 o365 tenant splunk
business travelers who roam to new locations may trigger this alert.	t1078 ml elastic
business workflows that occur very occasionally, and involve a business relationship with an organization in a country that does not routinely appear in network events, can trigger this alert. a new business workflow with an organization in a country with which no workflows previously existed may trigger this alert - although the model will learn that the new destination country is no longer anomalous as the activity becomes ongoing. business travelers who roam to many countries for brief periods may trigger this alert.	ml elastic
business workflows that occur very occasionally, and involve an unusual surge in network traffic, can trigger this alert. a new business workflow or a surge in business activity may trigger this alert. a misconfigured network application or firewall may trigger this alert.	ml elastic
by default a container is not allowed to access any devices on the host, but a \"privileged\" container is given access to all devices on the host. this allows the container nearly all the same access as processes running on the host. an administrator may want to run a privileged container to use operating system administrative capabilities such as manipulating the network stack or accessing hardware devices from within the cluster. add exceptions for trusted container images using the query field \"kubernetes.audit.requestobject.spec.container.image\"	T1610 t1611 kubernetes elastic
cases in which a user mounts an image file for legitimate reasons	t1566 t1566.001 windows sigma
ccm	t1047 t1059 t1059.001 windows sigma
certain applications may install root certificates for the purpose of inspecting ssl traffic.	t1553 windows macos elastic
certain applications may spawn from `slui.exe` that are legitimate. filtering will be needed to ensure proper monitoring.	t1548 t1548.002 endpoint splunk
certain kinds of security testing may trigger this alert. powershell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this alert.	t1059 ml elastic
certain programs or applications may modify files or change ownership in writable directories. these can be exempted by username.	t1222 linux elastic
certain software or administrative tasks may trigger false positives.	t1120 windows sigma
certain tools may create hidden temporary directories upon installation or as part of their normal behavior. these events can be filtered by the process arguments, username, or process name values.	t1564 linux elastic
certain tools may create hidden temporary files or directories upon installation or as part of their normal behavior. these events can be filtered by the process arguments, username, or process name values.	t1564 linux elastic
certain tools or automated software may enumerate hardware information. these tools can be exempted via user name or process arguments to eliminate potential noise.	t1082 cross-platform linux elastic
certain users or applications may create multiple service principals in a short period of time for legitimate purposes. filter as needed.	t1136.003 o365 tenant azure active directory splunk
certain utilities that delete files for disk cleanup or administrators manually removing backup files.	t1485 t1490 windows elastic
changes made to or by the local ntp service	t1070 t1070.006 windows sigma
changes to security groups to allow for new services to be deployed	t1190 aws sigma
changes to the shell profile tend to be noisy, a tuning per your environment will be required.	t1546 cross-platform elastic
changes to windows services or a rarely executed child process.	t1055 windows elastic
chrome instances using the exact same pipe name \"mojo.xxx\"	t1055 windows sigma
citrix	t1036 windows sigma
citrix configsync.ps1	t1059 t1059.001 windows sigma
clusterroles/roles being modified and deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
clusterroles/roles modification from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
clusters or instances may be deleted by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. cluster or instance deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 aws elastic
command execution on a virtual machine may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. command execution from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1059 azure elastic
command lines that use the same flags	t1003 t1003.001 t1036 windows sigma
commandlines containing components like cmd accidentally	t1134 t1134.001 t1134.002 windows sigma
commandlines that contains scriptures such as arabic or hebrew might make use of this character	t1036 t1036.002 windows sigma
commandlines with legitimate cyrillic text; will likely require tuning (or not be usable) in countries where these alphabets are in use.	t1036 t1036.003 windows sigma
commonly run by administrators	t1005 t1087 t1087.001 t1552 t1552.001 cisco sigma
commonly used by administrators for troubleshooting	t1016 t1018 t1033 t1049 t1057 t1082 t1083 t1124 t1201 cisco sigma
communication to other corporate systems that use ip addresses from public address spaces	t1218 t1218.011 windows sigma
companies, who may use these default ldap-attributes for personal information	t1001 t1001.003 windows sigma
company specific internal usage	windows sigma
compliance content searche exports may be executed for legitimate purposes, filter as needed.	t1114 T1114.002 o365 tenant splunk
compliance content searches may be executed for legitimate purposes, filter as needed.	t1114 T1114.002 o365 tenant splunk
confirm if the modification or deletion was part of a planned change or maintenance activity.	t1020 aws sigma
connecting to a vpn, performing activity and then dropping and performing additional activity.	t1078 azure sigma
consider adding exceptions to this rule to filter false positives if okta mfa rules are regularly modified in your organization.	t1562 okta elastic
consider adding exceptions to this rule to filter false positives if okta policies are regularly modified in your organization.	t1562 okta elastic
consider adding exceptions to this rule to filter false positives if oyour organization's okta network zones are regularly modified.	t1562 okta elastic
consider adding exceptions to this rule to filter false positives if sign on policies for okta applications are regularly modified or deleted in your organization.	t1556 okta elastic
consider adding exceptions to this rule to filter false positives if the mfa factors for okta user accounts are regularly reset in your organization.	t1098 okta elastic
consider adding exceptions to this rule to filter false positives if your organization's okta applications are regularly deleted and the behavior is expected.	t1489 okta elastic
container registry being created or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
container registry created or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
controller service accounts aren't normally assigned to running pods, this is abnormal behavior with very few legitimate use-cases and should result in very few false positives.	t1078 kubernetes elastic
copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator.	t1003 t1003.002 t1003.003 windows sigma
corrupted user profiles - https://social.technet.microsoft.com/wiki/contents/articles/3571.windows-user-profiles-service-event-1511-windows-cannot-find-the-local-profile-and-is-logging-you-on-with-a-temporary-profile.aspx	windows sigma
crazy web applications	t1505 t1505.003 t1584 t1587 linux sigma
createrole is not very common in common users. this search can be adjusted to provide specific values to identify cases of abuse. in general aws provides plenty of trust policies that fit most use cases.	t1078 aws account splunk
creating a hidden powershell service is rare and could key off of those instances.	t1569 t1569.002 endpoint splunk
creating a lambda function url configuration from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	aws sigma
creating a lambda function url configuration may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	aws sigma
creating and deleting a server object within 30 seconds or less is unusual but not impossible in a production environment. filter as needed.	t1207 endpoint splunk
creation of a new database that needs new security group rules	t1190 aws sigma
creation of legitimate files in sudoers.d folder part of administrator work	t1053 t1053.003 linux sigma
creation of non-default, legitimate at usage	t1218 t1547 windows sigma
custom applications may be allowed by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	o365 elastic
custom applications may leverage the kerberos protocol. filter as needed.	t1550 endpoint splunk
custom applications use renamed binaries adding slight change to binary name. typically this is easy to spot and add to whitelist	t1036 t1036.003 windows sigma
custom google workspace admin roles may be created by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1098 google_workspace elastic
custom organization-specific macos packages that use .pkg files to run curl could trigger this rule. if known behavior is causing false positives, it can be excluded from the rule.	t1059 t1071 macos elastic
custom role creations may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. role creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1078 gcp elastic
custom windows error reporting debugger or applications restarted by werfault after a crash.	t1036 t1546 windows elastic
datasvcutil.exe being executed from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1567 windows sigma
datasvcutil.exe being used may be performed by a system administrator.	t1567 windows sigma
db snapshot sharing is a common practice in aws environments. ensure that the sharing is authorized before taking action.	t1537 aws elastic
default browser not in the filter list.	t1566 t1566.001 endpoint splunk
deletion of a resource group may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. resource group deletions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 t1562 azure elastic
deletion of defender malware detections history for legitimate reasons	windows sigma
deletion of diagnostic settings may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. diagnostic settings deletion from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 azure elastic
deletions by unfamiliar users should be investigated. if the behavior is known and expected, it can be exempted from the rule.	t1078 t1078.004 t1531 aws sigma
dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button	t1546 t1546.003 windows sigma
dell power manager (c:\program files\dell\powermanager\dpmpowerplansetup.exe)	t1546 t1546.003 windows sigma
dell saremediation plugin folder (c:\program files\dell\saremediation\plugin\log.dll) is known to contain the 'log.dll' file.	t1574 t1574.001 t1574.002 windows sigma
depend on scripts and administrative tools used in the monitored environment (for example an admin scripts like https://www.itexperience.net/sccm-batch-files-and-32-bits-processes-on-64-bits-os/)	t1036 t1036.003 windows sigma
depending on the environment the rule might require some initial tuning before usage to avoid fp with third party applications	t1219 windows sigma
depending on the scripts, this rule might require some initial tuning to fit the environment	t1059 t1059.001 windows sigma
depending on your environment accepted applications may leverage this at times. it is recommended to search for anomalies inidicative of malware.	t1547 t1547.001 windows sigma
details for the risk calculation algorithm used by identity protection are unknown and may be prone to false positives.	t1110 T1110.003 t1586 t1586.003 azure active directory splunk
dev, uat, sat environment. you should apply this rule with prod account only.	t1486 t1565 aws sigma
dev, uat, sat environment. you should apply this rule with prod environment only.	t1562 aws sigma
developers may have a legitimate use for nodeports. for frontend parts of an application you may want to expose a service onto an external ip address without using cloud specific loadbalancers. nodeport can be used to expose the service on each node's ip at a static port (the nodeport). you'll be able to contact the nodeport service from outside the cluster, by requesting <nodeip>:<nodeport>. nodeport unlike loadbalancers, allow the freedom to set up your own load balancing solution, configure environments that aren't fully supported by kubernetes, or even to expose one or more node's ips directly.	t1133 kubernetes elastic
developers may leverage third-party applications for legitimate purposes in google workspace such as for administrative tasks.	t1078 t1550 google_workspace elastic
developers performing browsers plugin or extension debugging.	t1539 cross-platform elastic
device or device configuration being modified or deleted may be performed by a system administrator.	t1485 t1565 t1565.001 azure sigma
device or device configuration modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 t1565 t1565.001 azure sigma
diagnostics	t1003 windows sigma
direct ps command execution through sqlps.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action.	t1059 t1059.001 t1127 windows sigma
direct ps command execution through sqltoolsps.exe is uncommon, childprocess sqltoolsps.exe spawned by smss.exe is a legitimate action.	t1059 t1059.001 t1127 windows sigma
directories /dev/shm and /run/shm are temporary file storage directories in linux. they are intended to appear as a mounted file system, but uses virtual memory instead of a persistent storage device and thus are used for mounting file systems in legitimate purposes.	t1059 linux elastic
disabling a dkim configuration may be done by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1556 o365 elastic
disabling encryption may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. disabling encryption by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1565 aws elastic
disabling safe links may be done by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1566 o365 elastic
disabling these features for legitimate purposes is not a common use case but can still be implemented by the administrators. filter as needed.	t1112 endpoint splunk
disaster recovery events.	t1098 endpoint splunk
discord	t1007 t1012 t1547 t1547.001 windows sigma
discord was seen using chcp to look up code pages	t1614 t1614.001 windows sigma
disk device errors	t1027 t1027.001 windows sigma
dlls being loaded by user mode programs for legitimate reasons.	t1574 t1574.001 t1574.002 endpoint splunk
dministrator may execute this commandline tool for auditing purposes. filter as needed.	t1033 endpoint splunk
dns domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded.	t1572 ml elastic
dns queries for \"ufile\" are not malicious by nature necessarily. investigate the source to determine the necessary actions to take	t1567 t1567.002 windows sigma
dns zone modification from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1565 t1565.001 azure sigma
dns zone modified and deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	t1565 t1565.001 azure sigma
domain administrators may use this command-line utility for legitimate information gathering purposes.	t1018 t1482 windows elastic
domain controller logs	t1136 t1136.001 windows sigma
domain controller user logon	t1548 t1548.002 windows sigma
domain controllers acting as printer servers too? :)	t1021 t1021.002 windows sigma
domain controllers that are sometimes, commonly although should not be, acting as printer servers too	t1021 t1021.002 zeek sigma
domain controllers, authentication chokepoints, and vulnerability scanners.	t1110 T1110.003 account splunk
domain mergers and migrations may generate large volumes of false positives for this analytic.	t1134 t1134.005 endpoint splunk
domain-wide delegation of authority may be granted to service accounts by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1098 google_workspace elastic
downloading rar or powershell files from the internet may be expected for certain systems. this rule should be tailored to either exclude systems as sources or destinations in which this behavior is expected.	t1105 network elastic
dumping hives for legitimate purpouse i.e. backup or forensic investigation	t1003 t1003.002 t1003.004 t1003.005 t1012 windows sigma
during anaconda update the 'conda.exe' process will eventually execution the 'chcp' command.	t1614 t1614.001 windows sigma
during log rotation	t1070 windows sigma
during uninstallation of the iis service	t1070 windows sigma
during uninstallation of the tomcat server	t1070 windows sigma
eks cluster being created or deleted may be performed by a system administrator.	t1485 aws sigma
eks cluster created or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 aws sigma
email forwarding may be configured for legitimate purposes, filter as needed.	t1114 T1114.003 o365 tenant splunk
endpoint security installers, updaters and post installation verification scripts.	t1518 cross-platform elastic
enumeration of files and directories may not be inherently malicious and noise may come from scripts, automation tools, or normal command line usage. it's important to baseline your environment to determine the amount of expected noise and exclude any known fp's from the rule.	t1083 _deprecated elastic
environments that leverage dns responses over 60k bytes will result in false positives - if this traffic is predictable and expected, it should be filtered out. additionally, this detection rule could be triggered by an authorized vulnerability scan or compromise assessment.	t1210 network elastic
environments that use ntlmv1	t1550 t1550.002 windows sigma
event deletions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. events deletions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 t1562.001 azure sigma
event hub deletions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. event hub deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 azure elastic
eventbridge rules could be deleted or disabled by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. eventbridge rules being deleted or disabled by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1489 aws elastic
events deletions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. events deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 azure elastic
evernote	t1112 windows sigma
every user may do this event but very un-ussual.	t1036 t1036.003 endpoint splunk
exceptions can be added to this rule to filter expected behavior.	t1562 gcp sigma
excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission.	t1569 t1569.002 endpoint splunk
exclude dns servers from this rule as this is expected behavior. endpoints usually query local dns servers defined in their dhcp scopes, but this may be overridden if a user configures their endpoint to use a remote dns server. this is uncommon in managed enterprise networks because it could break intranet name resolution when split horizon dns is utilized. some consumer vpn services and browser plug-ins may send dns traffic to remote internet destinations. in that case, such devices or networks can be excluded from this rule when this is expected behavior.	_deprecated elastic
exclude legitimate (vetted) use of wmi event subscription in your network	t1546 t1546.003 windows sigma
execution of tools named gup.exe and located in folders different than notepad++\updater	t1574 t1574.002 windows sigma
expected fp with some electron based applications such as (1clipboard, beaker browser, caret, discord, github desktop, etc.)	t1218 windows sigma
expected if you legitimately use the advanced ip or port scanner utilities in your environement.	t1590 sigma
expected to be continuously seen on systems exposed to the internet	t1190 sigma
exploits that were attempted but unsuccessful.	t1021 t1021.006 t1068 t1190 t1203 t1210 zeek sigma
exporting a pst can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of pst content, it must be monitored.	t1114 m365 sigma
exporting snapshots may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. snapshot exports from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	aws _deprecated elastic
false positive are expected with legitimate sources	t1059 windows sigma
false positive is quite limited. filter is needed	t1555 t1555.003 endpoint splunk
false positive may include administrators using powerview for troubleshooting and management.	t1558 t1558.003 endpoint splunk
false positive may vary depends on the score you want to check. the bigger number of path traversal string count the better.	t1059 endpoint splunk
false positive might stem from rare extensions used by other office utilities.	t1587 t1587.001 windows sigma
false positive rate will vary depending on the environments. additional filters might be required to make this logic usable in production.	windows sigma
false positives are expected (e.g. in environments where winrm is used legitimately)	t1047 windows sigma
false positives are expected from google chrome installations running from user locations (appdata) and other custom locations. apply additional filters accordingly.	t1574 t1574.001 t1574.002 windows sigma
false positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. for example, event id 1122 is generated when a process attempts to load a dll that is blocked by an asr rule. this can be triggered by legitimate applications that attempt to load dlls that are not blocked by asr rules. this is block only.	t1059 t1566.001 t1566.002 endpoint splunk
false positives are expected if administrators access these function through proxy legitimatly. apply additional filters if necessary	okta sigma
false positives are expected if vlc is installed in non-default locations	t1574 t1574.001 t1574.002 windows sigma
false positives are expected in cases in which procdump just gets copied to a different directory without any renaming	t1003 t1003.001 t1036 windows sigma
false positives are expected since this rules is only looking for the dll load event. this rule is better used in correlation with related activity	t1574 t1574.002 windows sigma
false positives are expected with legitimate \".chm\"	t1218 t1218.001 windows sigma
false positives are expected. filtering will be needed to properly reduce legitimate applications from the results.	t1112 endpoint splunk
false positives are likely, as bitlockertogo.exe is a legitimate windows utility used for managing bitlocker encryption. however, the detection is designed to flag unusual execution patterns that deviate from standard usage. filtering may be required to reduce false positives, once confirmed - move to ttp.	t1218 endpoint splunk
false positives are limited as legitimate applications typically do not download files or xsl using wmic. filter as needed.	t1220 endpoint splunk
false positives are limited as this is a hunting query for inventory.	t1553.003 endpoint splunk
false positives are limited to zscalar configuration.	t1566 web server splunk
false positives are limited to zscaler configuration.	t1566 web server splunk
false positives are limited.	t1133 t1190 web server splunk
false positives are not expected with this analytic, since it is a hunting analytic. it is meant to show the use of asr rules and how they can be used to detect malicious activity.	t1059 t1566.001 t1566.002 endpoint splunk
false positives are not expected with this detection, unless within the organization there is a legitimate need for headless browsing accessing mockbin.org or mocky.io.	t1564.003 endpoint splunk
false positives are not expected, as the detection is based on the presence of web requests to the setupwizard.aspx page, which is not a common page to be accessed by legitimate users. note that the analytic is limited to http post and a status of 200 to reduce false positives. modify the query as needed to reduce false positives or hunt for additional indicators of compromise.	t1190 web proxy web server splunk
false positives are not expected, as this detection is based on monitoring http post requests to a specific endpoint with a status code of 200. however, ensure that legitimate requests to the `/wsstatusevents/eventhandler.asmx` endpoint are accounted for in the environment to avoid false positives.	t1190 web server splunk
false positives are not expected, as this detection is based on the presence of specific uri paths and http methods that are indicative of the cve-2024-27198 vulnerability exploitation. monitor, filter and tune as needed based on organization log sources.	t1190 web server splunk
false positives are not expected, however, monitor, filter, and tune as needed based on organization log sources. the analytic is restricted to 200 and get requests to specific uri paths, which should limit false positives.	t1190 web server splunk
false positives are possible and filtering may be required. restrict by assets or filter known jsp files that are common for the environment.	t1133 t1190 endpoint splunk
false positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. filter as needed based on command-line or processes that are used legitimately.	t1053 t1053.005 endpoint splunk
false positives are possible if legitimate applications are allowed to terminate this process during testing or updates. filter as needed based on paths that are used legitimately.	t1489 endpoint splunk
false positives are possible if legitimate processes are loading vcruntime140.dll from non-standard directories. it is recommended to investigate the context of the process loading vcruntime140.dll to determine if it is malicious or not. modify the search to include additional known good paths for vcruntime140.dll to reduce false positives.	t1547 t1574.002 endpoint splunk
false positives are possible if legitimate users are attempting to bypass application restrictions. this could occur if a user is attempting to run an application that is not permitted by applocker. it is recommended to investigate the context of the bypass attempt to determine if it is malicious or not. modify the threshold as needed to reduce false positives.	t1218 endpoint splunk
false positives are possible if legitimate users are executing applications from file paths that are not permitted by applocker. it is recommended to investigate the context of the application execution to determine if it is malicious or not. modify the threshold as needed to reduce false positives.	t1218 endpoint splunk
false positives are possible if legitimate users are launching applications that are not permitted by applocker. it is recommended to investigate the context of the application launch to determine if it is malicious or not. modify the threshold as needed to reduce false positives.	t1218 endpoint splunk
false positives are possible if the environment is using certificates for authentication.	t1003 endpoint splunk
false positives are possible if the organization adds new forms to outlook via an automated method. filter by name or path to reduce false positives.	t1112 t1566 endpoint splunk
false positives are possible with native utilities and third party applications. filtering may be needed based on command-line, or add world writeable paths to restrict query.	t1218 t1218.011 endpoint splunk
false positives are possible, filtering may be required to restrict to workstations vs domain controllers. filter as needed.	t1558 endpoint splunk
false positives are present based on automated tooling or system administrative usage. filter as needed.	t1014 t1082 t1548 t1548.003 endpoint splunk
false positives are present when the values are set to 1 for utf and lookup. it's possible to raise this to ttp (direct notable) if removal of other_lookups occur and score is raised to 2 (down from 4).	t1133 t1190 t1505 t1505.003 web server splunk
false positives are unknown and filtering may be required.	t1547 T1547.012 endpoint splunk
false positives can be found in environments using messagent for remote management, analysis should prioritize the grandparent process, messagent.exe, and scrutinize the resulting child processes triggered by any suspicious interactive commands directed at the target host.	t1219 windows sigma
false positives can occur because the rules may be mapped to a few mitre att&ck tactics. use the attached timeline to determine which detections were triggered on the host.	cross-platform elastic
false positives can occur with generic built-in accounts, such as administrator, admin, etc. if they are widespread used in your environment. as a best practice, they shouldn't be used in day-to-day tasks, as it prevents the ability to quickly identify and contact the account owner to find out if an alert is a planned activity, regular business activity, or an upcoming incident.	cross-platform elastic
false positives could occur from other custom installation paths. apply additional filters accordingly.	t1574 t1574.001 t1574.002 windows sigma
false positives could occur since service termination could happen due to multiple reasons	windows sigma
false positives depend on custom use of vsls-agent.exe	t1218 windows sigma
false positives depend on scripts and administrative tools used in the monitored environment	t1036 t1059 t1059.007 t1082 t1087 t1105 t1140 t1218 t1218.005 t1218.007 t1218.011 windows sigma
false positives have been limited when the anonymous logon is used for account name.	t1187 endpoint splunk
false positives have been minimized by removing attempts that result in 'mfa successfully completed messages', which were found to be generated when a user opts to use a different mfa method than the default. further reductions in notable events can be achieved through filtering 'mfa denied; duplicate authentication attempt' messages within the auth_msg field, as they could arguably be considered as false positives.	t1078 t1078.004 t1586 t1586.003 t1621 azure active directory splunk
false positives in pdf file opened pdf viewer having legitimate url link, however filter as needed.	t1566 t1566.001 endpoint splunk
false positives levels will differ depending on the environment. you can use a combination of parentimage and other keywords from the commandline field to filter legitimate activity	t1070 t1070.004 windows sigma
false positives may arise from legitimate actions by administrators or network operators who may use these commands for automation purposes. therefore, it's recommended to adjust filter macros to eliminate such false positives.	t1053 t1053.003 endpoint splunk
false positives may arise from legitimate applications that create tasks to run as system. therefore, it's recommended to adjust filters based on parent process or modify the query to include world writable paths for restriction.	t1053 t1053.005 endpoint splunk
false positives may arise in the rdp hijacking analytic when legitimate administrators access remote sessions for maintenance or troubleshooting purposes. these activities might resemble an attacker''s attempt to hijack a disconnected session, leading to false alarms. to mitigate the risk of false positives and improve the overall security posture, organizations can implement group policy to automatically disconnect rdp sessions when they are complete. by enforcing this policy, administrators ensure that disconnected sessions are promptly terminated, reducing the window of opportunity for an attacker to hijack a session. additionally, organizations can also implement access control mechanisms and monitor the behavior of privileged accounts to further enhance security and reduce the chances of false positives in rdp hijacking detection.	t1543.003 t1563 t1563.002 endpoint splunk
false positives may arise when administrators or network operators create files in systemd directories for legitimate automation tasks. therefore, it's important to adjust filter macros to account for valid activities. to implement this search successfully, it's crucial to ingest appropriate logs, preferably using the linux sysmon add-on from splunkbase for those using sysmon.	t1053 T1053.006 endpoint splunk
false positives may be caused by administrators resetting spns or querying for spns. filter as needed.	t1558.003 endpoint splunk
false positives may be generated based on an automated process or service that exports certificates on the regular. review is required before setting to alert. monitor for abnormal processes performing an export.	t1552 t1552.004 t1649 endpoint splunk
false positives may be generated by administrators installing benign applications using run-as/elevation.	t1068 t1134 t1548 endpoint splunk
false positives may be generated by normal provisioning workflows for user device registration.	t1078 t1098.005 t1110 t1556.006 t1621 identity splunk
false positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration.	t1098.005 t1556.006 t1621 identity splunk
false positives may be generated by process executions within the commandline, regex has been provided to minimize the possibilty.	t1564 t1564.004 endpoint splunk
false positives may be generated by users working out the geographic region where the organizations services or technology is hosted.	t1098.005 t1556.006 t1621 identity splunk
false positives may be generated in environments where administrative users or processes are allowed to generate certificates with subject alternative names. sources or templates used in these processes may need to be tuned out for accurate function.	t1649 endpoint splunk
false positives may be high based on legitimate scripted code in any environment. filter as needed.	t1059 t1059.003 endpoint splunk
false positives may be high depending on the environment and consistent use of isos. restrict to servers, or filter out based on commonly used iso names. filter as needed.	t1566 t1566.001 endpoint splunk
false positives may be limited to source control applications and may be required to be filtered out.	t1105 endpoint splunk
false positives may be possible, however we restricted it to http status 200 and post requests, based on the poc. upon investigation review the post body for the actual payload - or command - being executed.	t1190 web server splunk
false positives may be present and filtering may be required. certain utilities will run from non-standard paths based on the third-party application in use.	t1036 t1036.003 t1218 T1218.004 endpoint splunk
false positives may be present and filtering may need to occur based on legitimate application usage. filter as needed.	t1218.008 endpoint splunk
false positives may be present and filtering may need to occur based on organization endpoint behavior.	t1055 endpoint splunk
false positives may be present and filtering will need to occur by parent process or command line argument. it may be required to modify this query to an edr product for more granular coverage.	t1059 t1059.001 t1105 endpoint splunk
false positives may be present and may need to be reviewed before this can be turned into a ttp. in addition, remove .pfx (standalone) if it's too much volume.	t1649 endpoint splunk
false positives may be present and some filtering may be required.	t1546 t1546.015 endpoint splunk
false positives may be present and tuning will be required before turning into a ttp or notable.	t1546.012 endpoint splunk
false positives may be present and will need to be filtered.	t1542 t1547.001 endpoint splunk
false positives may be present and will require some tuning based on processes. filter as needed.	t1027 endpoint splunk
false positives may be present and will require tuning based on program ids in large organizations.	t1112 endpoint splunk
false positives may be present as the file pattern does match legitimate files on disk. it is possible other native tools write the same file name scheme.	t1027 endpoint splunk
false positives may be present based on administrative use. filter as needed.	t1569.002 t1570 endpoint splunk
false positives may be present based on administrators using rdp files for legitimate purposes. filter as needed.	t1021.001 T1598.002 endpoint splunk
false positives may be present based on automated tooling or system administrators. filter as needed.	t1649 endpoint splunk
false positives may be present based on common applications adding new drivers, however, filter as needed.	t1068 t1543 t1543.003 endpoint splunk
false positives may be present based on developers or third party utilities adding items to the gac.	t1505 t1505.004 endpoint splunk
false positives may be present based on file version, modify the analytic to only look for version between 18.12.407 and 18.12.416 as needed.	T1195.002 endpoint splunk
false positives may be present based on legacy applications or utilities. win32_scheduledjob uses the remote procedure call (rpc) protocol to create scheduled tasks on remote computers. it uses the dcom (distributed component object model) infrastructure to establish a connection with the remote computer and invoke the necessary methods. the rpc service needs to be running on both the local and remote computers for the communication to take place.	t1059 t1059.001 endpoint splunk
false positives may be present based on legitimate applications or third party utilities. filter out any additional parent process names.	t1105 endpoint splunk
false positives may be present based on legitimate software being utilized. filter as needed.	t1027 t1059.004 endpoint splunk
false positives may be present based on legitimate third party applications needing to install drivers. filter, or allow list known good drivers consistently being installed in these paths.	t1014 t1068 endpoint splunk
false positives may be present based on macro based approved documents in the organization. filtering may be needed.	t1566 t1566.001 endpoint splunk
false positives may be present based on organization size and configuration of okta.	T1538 T1550.004 okta tenant splunk
false positives may be present based on organization use of applocker. filter as needed.	t1562 t1562.001 endpoint splunk
false positives may be present based on organization use of citrix adc and gateway. filter, or restrict the analytic to citrix devices only.	t1190 web server splunk
false positives may be present based on organization use of saml utilities. filter, or restrict the analytic to citrix devices only.	t1190 network splunk
false positives may be present based on proxy usage internally. filter as needed.	t1090 t1095 endpoint splunk
false positives may be present based on sourceimage paths. if removing the paths is important, realize svchost and many native binaries inject into notepad consistently. restrict or tune as needed.	t1055 T1055.002 endpoint splunk
false positives may be present based on third-party applications or administrators using cim. it is recommended to apply appropriate filters as needed to minimize the number of false positives.	t1047 endpoint splunk
false positives may be present from automation based applications (sccm), filtering may be required. in addition, break the query out based on volume of usage. filter process names or file paths.	t1546.003 endpoint splunk
false positives may be present if a suspicious processname is similar to a benign processname.	t1059 endpoint splunk
false positives may be present if an application is dumping processes, filter as needed. recommend reviewing createdump.exe usage across the fleet to better understand all usage and by what.	t1003.001 endpoint splunk
false positives may be present if dns data exfiltration request look very similar to benign dns requests.	t1048.003 endpoint splunk
false positives may be present if dns txt record contents are similar to benign dns txt record contents.	t1568.002 endpoint splunk
false positives may be present if domain name is similar to dga generated domains.	t1568.002 endpoint splunk
false positives may be present if gacutil.exe is utilized day to day by developers. filter as needed.	t1505 t1505.004 endpoint splunk
false positives may be present if ngrok is an authorized utility. filter as needed.	t1090 t1102 t1572 endpoint splunk
false positives may be present if the activity is blocked or was not successful. filter known vulnerablity scanners. filter as needed.	t1133 t1190 web server splunk
false positives may be present if the application is legitimately used, filter by user or endpoint as needed.	t1059 t1564.003 t1564.006 endpoint splunk
false positives may be present if the organization allows for ssh tunneling outbound or internally. filter as needed.	t1021.004 t1572 endpoint splunk
false positives may be present if the organization works with international businesses. filter as needed.	t1573 network splunk
false positives may be present if the vbscript syncappvpublishingserver is used for legitimate purposes. filter as needed. adding a n; to the command-line arguments may help reduce any noise.	t1216 t1218 endpoint splunk
false positives may be present in some instances of legitimate applications requiring to export certificates. filter as needed.	t1649 endpoint splunk
false positives may be present in some instances of legitimate binaries with invalid signatures. filter as needed.	t1553.003 endpoint splunk
false positives may be present on linux desktop as it may commonly be used by administrators or end users. filter as needed.	t1115 endpoint splunk
false positives may be present on recent windows operating systems. filtering may be required based on process_name. in addition, look for non-standard, unsigned, module loads into lsass. if query is too noisy, modify by adding endpoint.processes process_name to query to identify the process making the modification.	t1547.008 t1548.002 endpoint splunk
false positives may be present only if scripts or administrators are disabling logging. filter as needed by parent process or other.	t1505 t1505.004 t1562 t1562.002 endpoint splunk
false positives may be present until properly tuned. filter as needed.	t1505 t1505.004 endpoint splunk
false positives may be present when an administrator utilizes the cmdlets in the query. filter or monitor as needed.	t1059 t1059.001 endpoint splunk
false positives may be present when updates or an administrator adds a new module to iis. monitor and filter as needed.	t1505 t1505.004 endpoint splunk
false positives may be present with legitimate applications. attempt to filter by dest ip or use asset groups to restrict to confluence servers.	t1190 web application web server splunk
false positives may be present, as this is based on the admin user accessing the papercut ng instance from a public ip address. filter as needed.	t1133 t1190 web server splunk
false positives may be present, but most likely not. filter as needed.	t1059 t1133 t1190 endpoint splunk
false positives may be present, filter as needed based on administrative activity.	t1543 t1543.003 endpoint splunk
false positives may be present, filter as needed.	t1068 t1069.002 t1105 t1133 t1190 t1547.006 t1548 t1548.003 web server endpoint splunk
false positives may be present, filter as needed. added .xml to potentially capture any answer file usage. remove as needed.	t1218 endpoint splunk
false positives may be present, filter by destination or parent process as needed.	t1218.007 endpoint splunk
false positives may be present, filter on dll name or parent process.	t1218 t1218.013 endpoint splunk
false positives may be present, filtering may be needed. also, restricting to known web servers running iis or sharefile will change this from hunting to ttp.	t1190 network splunk
false positives may be present, filtering may be required. remove the windows shells macro to determine if other utilities are using iscsicpl.exe.	t1574.001 endpoint splunk
false positives may be present, restrict to cisco ios xe devices or perimeter appliances. modify the analytic as needed based on hunting for successful exploitation of cve-2023-20198.	t1190 network splunk
false positives may be present. filter based on pipe name or process.	t1071 endpoint splunk
false positives may be present. filtering may be required before setting to alert.	t1588.002 endpoint splunk
false positives may be present. modify the query as needed to post, or add additional filtering (based on log source).	t1133 t1190 network splunk
false positives may be present. tune as needed.	t1059.001 t1069 t1069.001 t1482 endpoint splunk
false positives may be present. tune okta and tune the analytic to ensure proper fidelity. modify risk score as needed. drop to anomaly until tuning is complete.	t1110 infrastructure okta tenant splunk
false positives may be triggered from newly installed event providers or windows updates, new \"channelaccess\" values must be investigated.	t1562.002 endpoint splunk
false positives may occur and filtering may be required. restrict analytic to asset type.	t1133 t1190 web server splunk
false positives may occur depending on the web server's configuration. if the web server is intentionally configured to utilize the remote shellservlet, then the detections by this analytic would not be considered true positives.	t1190 web server splunk
false positives may occur if a user called rundll32 from cli with no options	t1021 t1021.002 t1569 t1569.002 t1570 windows sigma
false positives may occur if applications are typically disabling asr rules in the environment. monitor for changes to asr rules to determine if this is a false positive.	t1112 endpoint splunk
false positives may occur if legitimate office documents are creating scheduled tasks. ensure to investigate the scheduled task and the command to be executed. if the task is benign, add the task name to the exclusion list. some applications may legitimately load taskschd.dll.	t1566 t1566.001 endpoint splunk
false positives may occur if legitimate office documents are executing macro code. ensure to investigate the macro code and the command to be executed. if the macro code is benign, add the document name to the exclusion list. some applications may legitimately load vbe7intl.dll, vbe7.dll, or vbeui.dll.	t1566 t1566.001 endpoint splunk
false positives may occur if legitimate outlook processes are modified.	t1112 endpoint splunk
false positives may occur if legitimate processes are writing to world-writable directories. it is recommended to investigate the context of the file write operation to determine if it is malicious or not. modify the search to include additional known good paths for `mshta.exe` to reduce false positives.	t1218.005 endpoint splunk
false positives may occur if legitimate pswa processes are used for administrative tasks. careful review of the logs is recommended to distinguish between legitimate and malicious activity.	t1190 web server endpoint splunk
false positives may occur if legitimate software writes to these paths. modify the search to include additional file name extensions. to enhance it further, adding a join on processes.process_name may assist with restricting the analytic to specific process names. investigate the process and file to determine if it is malicious.	t1218.005 endpoint splunk
false positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. so always make sure that the driver being loaded is the legitimate one and the non vulnerable version.	t1068 t1543 t1543.003 windows sigma
false positives may occur if there are legitimate accounts with the privilege to drop files in the root of the c drive. it's recommended to verify the legitimacy of such actions and the accounts involved.	t1069.001 endpoint splunk
false positives may occur if there are legitimate activities that mimic the exploitation pattern. it's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.	t1068 web server splunk
false positives may occur if users are granting consents as part of legitimate application integrations or setups. it is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices.	t1528 azure tenant splunk
false positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. a baseline is required before production use.	windows sigma
false positives may occur if you execute the script from one of the paths mentioned in the rule. apply additional filters that fits your org needs.	t1218 windows sigma
false positives may occur when users are using a vpn or when users are traveling to different locations for legitimate purposes.	t1078 o365 elastic
false positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). exclude all the specific trusted tasks before using this rule	t1053 t1053.005 windows sigma
false positives may occur with troubleshooting scripts	t1562 t1562.001 windows sigma
false positives may occur, depending on the organization's size and the configuration of okta.	t1539 okta tenant splunk
false positives may occur, therefore utilize the analytic as a jump off point to identifiy potential certificate store errors.	t1190 web server splunk
false positives may occur. it is recommended to fine-tune okta settings and the analytic to ensure high fidelity. adjust the risk score as necessary.	t1078 t1078.004 infrastructure splunk
false positives may only pertain to it not being related to empire, but another framework. filter as needed if any applications use the same pattern.	t1059 t1059.001 endpoint splunk
false positives may trigger the detections certain scenarios like directory service delays or out of date lookups. filter as needed.	t1558 endpoint splunk
false positives may vary based on microsfot defender configuration; monitor and filter out the alerts that are not relevant to your environment.	endpoint splunk
false positives may vary by endpoint protection tool; monitor and filter out the alerts that are not relevant to your environment.	endpoint splunk
false positives might occur due to the nature of the scriptblock being ingested as a big blob. initial tuning is required.	t1518 t1518.001 windows sigma
false positives might occur if the users are unaware of such control checks	t1059 windows sigma
false positives should be limited as `services.exe` should never spawn a process from `admin$`. filter as needed.	t1548 endpoint splunk
false positives should be limited as day to day scripts do not use this method.	t1059 t1059.001 endpoint splunk
false positives should be limited as developers do not spawn msbuild via a wsh.	t1127 t1127.001 endpoint splunk
false positives should be limited as it is specific to advancedrun. filter as needed based on legitimate usage.	t1588.002 endpoint splunk
false positives should be limited as the activity is not common to delete only the sd from the registry. filter as needed. update the analytic modified or deleted values based on product that is in the datamodel.	t1053.005 t1562 endpoint splunk
false positives should be limited as the analytic is specific to a filename with extension .zip. filter as needed.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 endpoint splunk
false positives should be limited as the analytic is specific to screenconnect path traversal attempts. tune as needed, or restrict to specific hosts if false positives are encountered.	t1190 endpoint splunk
false positives should be limited as the arguments used are specific to sharphound. filter as needed or add more command-line arguments as needed.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 endpoint splunk
false positives should be limited as the command-line arguments are specific to soaphound. filter as needed.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 endpoint splunk
false positives should be limited as the commands being identifies are quite specific to eventcode 4104 and mimikatz. filter as needed.	t1003 t1059.001 endpoint splunk
false positives should be limited as the destination port is specific to active directory web services protocol, however we recommend utilizing this analytic to hunt for non-standard processes querying the adws port. filter by app or dest_ip to ad servers and remove known proceses querying adws.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 network splunk
false positives should be limited as there is a small subset of binaries that contain the original file name of ab.exe. filter as needed.	t1059 endpoint splunk
false positives should be limited as this analytic identifies renamed instances of `rclone.exe`. filter as needed if there is a legitimate business use case.	t1020 endpoint splunk
false positives should be limited as this analytic is designed to detect a specific utility. it is recommended to apply appropriate filters as needed to minimize the number of false positives.	t1047 endpoint splunk
false positives should be limited as this behavior is not normal for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.	t1560 t1560.001 endpoint splunk
false positives should be limited as this detection is based on a specific url path and http status code. adjust the search as necessary to fit the environment.	t1190 web server splunk
false positives should be limited as this is a strict primary indicator used by snake malware.	t1547.006 t1569.002 endpoint splunk
false positives should be limited as this is directly looking for mimikatz, the credential dumping utility.	t1003 endpoint splunk
false positives should be limited as this is restricted to the rclone process name. filter or tune the analytic as needed.	t1020 endpoint splunk
false positives should be limited as this is specific to a file attribute not used by anything else. filter as needed.	t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 endpoint splunk
false positives should be limited as this is specific to krbrelayup based attack. filter as needed.	t1543.003 endpoint splunk
false positives should be limited as winhlp32.exe is typically not used with the latest flavors of windows os. however, filter as needed.	t1055 endpoint splunk
false positives should be limited to as this is strict to active exploitation. reduce noise by filtering to f5 devices with tmui enabled or filter data as needed.	network splunk
false positives should be limited, but if another service out there is named sliver, filtering may be needed.	t1569 t1569.002 endpoint splunk
false positives should be limited, but if any are present, filter as needed.	t1003 t1003.002 t1566 t1566.001 endpoint splunk
false positives should be limited, but if any are present, filter as needed. in some instances, `cscript.exe` is used for legitimate business practices.	t1003 t1003.002 endpoint splunk
false positives should be limited, filter as needed. add additional shells as needed.	t1055 endpoint splunk
false positives should be limited, filter as needed. in our test case, remcos used regsvr32.exe to modify the registry. it may be required, dependent upon the edr tool producing registry events, to remove (default) from the command-line.	t1112 t1218.010 endpoint splunk
false positives should be limited, however filter as needed.	t1558.003 t1562.001 t1566 t1566.001 endpoint splunk
false positives should be limited, however filtering may be required.	t1105 endpoint splunk
false positives should be limited, however it is possible to filter by processes.process_name and specific processes (ex. wscript.exe). filter as needed. this may need modification based on edr telemetry and how it brings in registry data. for example, removal of (default).	t1055 t1055.001 t1059 t1559.001 endpoint splunk
false positives should be limited, however tune or filter as needed.	t1190 web application splunk
false positives should be limited.	t1543 t1543.003 endpoint splunk
false positives should be limited. filter as needed.	t1003 t1003.002 t1027 t1041 t1059 t1059.001 endpoint splunk
false positives should be minimal, given the high fidelity of this detection. marker.	t1078 t1078.001 okta tenant splunk
false positives should be very limited as this is strict to metasploit behavior.	t1059 t1059.001 endpoint splunk
false positives should be very low with the extensions list cited. especially if you don't heavily utilize onenote.	windows sigma
false positives will be found. filter as needed and create higher fidelity analytics based off banned remote access software.	t1219 endpoint splunk
false positives will be found. https and http is a url protocol handler that will trigger this analytic. tune based on process or command-line.	t1059 endpoint splunk
false positives will be generated based on normal certificate requests. leave enabled to generate risk, as this is meant to be an anomaly analytic.	t1649 endpoint splunk
false positives will be generated based on normal certificate store backups. leave enabled to generate risk, as this is meant to be an anomaly analytic. if cs backups are not normal, enable as ttp.	t1649 endpoint splunk
false positives will be generated based on normal certificates issued. leave enabled to generate risk, as this is meant to be an anomaly analytic.	t1649 endpoint splunk
false positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. filter by user, process, or thumbprint.	t1553 t1553.004 endpoint splunk
false positives will be limited to administrative scripts disabling hvci. filter as needed.	t1562 t1562.001 endpoint splunk
false positives will be limited to applications that require rasautou.exe to load a dll from disk. filter as needed.	t1055 t1055.001 t1218 endpoint splunk
false positives will be limited to legitimate applications creating a task to run as system. filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.	t1053 t1053.005 endpoint splunk
false positives will be limited to the number of events generated by the analytics tied to the stories. analytics will need to be tested and tuned, and the risk score reduced as needed based on the organization.	t1078 t1110 okta tenant splunk
false positives will be limited, however tune or modify the query as needed.	t1133 t1190 web server splunk
false positives will be present and filtering is required.	t1218.007 endpoint splunk
false positives will be present and filtering will be required. legitimate ips will be present and need to be filtered.	T1542.003 endpoint splunk
false positives will be present as this is meant to assist with filtering and tuning.	t1218.008 endpoint splunk
false positives will be present based on gateways in use, modify the status field as needed.	t1068 t1133 t1190 t1210 web server splunk
false positives will be present based on legitimate software, filtering may need to occur.	t1048.003 endpoint splunk
false positives will be present based on many factors. tune the correlation as needed to reduce too many triggers.	t1003 t1012 t1016 t1033 t1049 t1059 t1069 t1082 t1112 t1115 t1222 t1529 t1548 t1552 endpoint splunk
false positives will be present based on organizations that allow the use of ngrok. filter or monitor as needed.	t1090 t1102 t1572 endpoint splunk
false positives will be present based on paths. filter or add other paths to the exclusion as needed.	t1574 t1574.001 endpoint splunk
false positives will be present for accessing the 3cx[.]com website. remove from the lookup as needed.	T1195.002 network splunk
false positives will be present if any scripts are adding to inprocserver32. filter as needed.	t1059 t1059.001 t1546.015 endpoint splunk
false positives will be present until all module failures are resolved or reviewed.	t1505 t1505.004 endpoint splunk
false positives will be present with msiexec spawning cmd or powershell. filtering will be needed. in addition, add other known discovery processes to enhance query.	t1218.007 endpoint splunk
false positives will be present, filter as needed or restrict to critical assets on the perimeter.	t1563.002 endpoint splunk
false positives will be present. drill down into the driver further by version number and cross reference by signer. review the reference material in the lookup. in addition, modify the query to look within specific paths, which will remove a lot of \"normal\" drivers.	t1543.003 endpoint splunk
false positives will be present. filter as needed.	t1068 endpoint splunk
false positives will be present. filter based on actionname paths or specify keywords of interest.	t1053.005 endpoint splunk
false positives will be present. this query is meant to help tune other curl and wget analytics.	t1105 endpoint splunk
false positives will be present. tune and then change type to ttp.	t1105 endpoint splunk
false positives will differ depending on the environment and scripts used. apply additional filters accordingly.	windows sigma
false positives will most likely be present based on risk scoring and how the organization handles system to system communication. filter, or modify as needed. in addition to count by analytics, adding a risk score may be useful. in our testing, with 22 events over 30 days, the risk scores ranged from 500 to 80,000. your organization will be different, monitor and modify as needed.	t1210 t1484 endpoint splunk
false positives will occur based on grantedaccess 0x1010 and 0x1400, filter based on source image as needed or remove them. concern is cobalt strike usage of mimikatz will generate 0x1010 initially, but later be caught.	t1003 t1003.001 endpoint splunk
false positives will occur based on grantedaccess and sourceuser, filter based on source image as needed. utilize this hunting analytic to tune out false positives in ttp or anomaly analytics.	t1003 t1003.001 endpoint splunk
false positives will occur based on legitimate application requests, filter based on source image as needed.	t1003 t1003.001 endpoint splunk
false positives will only be present if a process legitimately writes a .cab file to disk. modify the analytic as needed by file path. filter as needed.	t1566.001 endpoint splunk
false positives will only be present if the msiexec process legitimately spawns windbg. filter as needed.	t1218.007 endpoint splunk
false positives will only be present if the windbg process legitimately spawns autoit3. filter as needed.	t1059 endpoint splunk
false postitve can occur in cases where admin scripts levreage the \"exec\" flag to execute applications	t1218 windows sigma
false postitve might occur with legitimate or uncommon extensions used internally. initial baseline is required.	t1218 windows sigma
false-positives (fp) can appear if another remote terminal service is being used to connect to it's listener but typically ssh is used in these scenarios.	t1095 t1548 _deprecated elastic
false-positives (fp) can appear if the pid file is legitimate and holding a process id as intended. to differentiate, if the pid file is an executable or larger than 10 bytes, it should be ruled suspicious.	t1106 linux elastic
false-positives (fp) should be at a minimum with this detection as pid files are meant to hold process ids, not inherently be executables that spawn processes.	t1059 linux elastic
faulty legacy applications	t1212 windows sigma
federation settings being modified or deleted may be performed by a system administrator.	t1078 azure sigma
federation settings modified from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1078 azure sigma
fidelity of this is high as it is okta threatinsight. filter and modify as needed.	t1078 t1078.001 T1110.003 T1110.004 infrastructure splunk
fidelity of this is high as okta is specifying malicious infrastructure. filter and modify as needed.	t1078 t1078.001 t1556 infrastructure splunk
file located in the appdata folder with trusted signature	t1566 t1566.001 windows sigma
file names with legitimate cyrillic text. will likely require tuning (or not be usable) in countries where these alphabets are in use.	t1036 t1036.003 windows sigma
file system or mount being deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. file system mount deletion by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 aws elastic
filenames that contains scriptures such as arabic or hebrew might make use of this character	t1036 t1036.002 windows sigma
files generated during installation will generate a lot of noise, so the rule should only be enabled after the fact.	t1190 t1210 windows elastic
files that accidentally contain these strings	t1552 t1552.001 windows sigma
files that are interacted with that have these extensions legitimately	t1027 t1027.005 t1070 t1070.004 t1485 t1553 t1553.002 windows sigma
files with mimikatz in their filename	t1003 t1003.001 t1003.002 t1003.004 t1003.006 windows sigma
filter and modify the analytic as you'd like. filter based on path. remove the system32\drivers and look for non-standard paths.	t1068 endpoint splunk
filter internet browser application to minimize the false positive of this detection.	t1590 T1590.005 endpoint splunk
filtering may be required in some instances, filter as needed.	t1190 web server splunk
filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on asset type.	t1133 t1190 endpoint splunk
filtering may be required. in addition to aws credentials, add other important files and monitor. the inverse would be to look for _all_ -f behavior and tune from there.	t1105 endpoint splunk
filtering may be requried based on automated utilities and third party applications that may export certificates.	t1649 endpoint splunk
filtering will be required as system administrators will add and remove. one way to filter query is to add \"echo\".	T1098.004 endpoint splunk
firewall acl's may be deleted by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. web acl deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
firewall being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	t1562 t1562.004 azure sigma
firewall modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 t1562.004 azure sigma
firewall policy being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	t1562 t1562.007 azure sigma
firewall policy deletions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. firewall policy deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 azure elastic
firewall policy modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 t1562.007 azure sigma
firewall rule configuration being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
firewall rule configuration modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
firewall rules being modified or deleted may be performed by a system administrator. verify that the firewall configuration change was expected.	t1562 gcp sigma
firewall rules may be created by system administrators. verify that the firewall configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 gcp elastic
firewall rules may be deleted by system administrators. verify that the firewall configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 gcp elastic
firewall rules may be modified by system administrators. verify that the firewall configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 gcp elastic
for additional tuning, severity exceptions for google_workspace.alert.metadata.severity can be added.	google_workspace elastic
forwarding mail flow rules may be created for legitimate reasons, filter as needed.	t1114 o365 tenant splunk
fp could be caused by legitimate application writing shortcuts for example. this folder should always be inspected to make sure that all the files in there are legitimate	t1547 t1547.001 windows sigma
fp could occur if the legitimate version of vmguestlib already exists on the system	t1574 t1574.001 t1574.002 windows sigma
fqdns that start with a number such as \"7-zip\"	t1218 t1218.010 windows sigma
ftp servers should be excluded from this rule as this is expected behavior. some business workflows may use ftp for data exchange. these workflows often have expected characteristics such as users, sources, and destinations. ftp activity involving an unusual source or destination may be more suspicious. ftp activity involving a production server that has no known associated ftp workflow or business requirement is often suspicious.	t1048 _deprecated elastic
full network packet capture may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. full network packet capture from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1040 azure elastic
fullaccess mailbox delegation may be assigned for legitimate purposes, filter as needed.	t1098 T1098.002 o365 tenant splunk
gcp oauth token abuse detection will only work if there are access policies in place along with audit logs.	t1078 gcp account splunk
gcp storage buckets can be accessed from any ip (if the acls are open to allow it), as long as it can make a successful connection. this will be a false postive, since the search is looking for a new ip within the past two hours.	T1530 gcp storage bucket splunk
general usage of group policy will trigger this detection, also please not gpos modified using tools such as sharpgpoabuse will not generate the ad audit events which enable this detection.	t1222 t1222.001 t1484 t1484.001 endpoint splunk
generally used to copy configs or ios images	t1074 t1105 t1560 t1560.001 cisco sigma
genuine activity	t1098 t1562 endpoint splunk
genuine dc promotion may trigger this alert.	t1003 t1003.006 endpoint splunk
get requests will be noisy and need to be filtered out or removed from the query based on volume. restrict analytic to known publically facing fortigates, or run analytic as a hunt until properly tuned. it is also possible the user agent may be filtered on report runner or node.js only for the exploit, however, it is unknown at this if other user agents may be used.	t1133 t1190 network splunk
getsessiontoken may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. getsessiontoken from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1548 t1550 aws elastic
getsignintoken events will occur when using aws sso portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. non-sso configured roles would be abnormal and should be investigated.	t1021 t1021.007 t1550 t1550.001 aws sigma
github operations such as ghe-backup	t1059 linux sigma
global administrator additions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. global administrator additions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1098 azure elastic
glue development endpoint activity may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	aws sigma
go utilities that use staaldraad awesome ntlm library	t1059 t1087 t1114 t1550 t1550.002 windows sigma
google chrome googleupdate.exe	t1003 t1003.001 windows sigma
google cloud kubernetes admission controller may be done by a system administrator.	t1078 t1552 t1552.007 gcp sigma
google cloud kubernetes cronjob/job may be done by a system administrator.	gcp sigma
google drive	t1036 windows sigma
google workspace admin role assignments may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1098 google_workspace elastic
google workspace admin role privileges, may be modified by system administrators.	t1098 gcp sigma
google workspace admin roles may be deleted by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1531 google_workspace elastic
google workspace admin roles may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1098 google_workspace elastic
google workspace administrators may adjust change which organizational unit a user belongs to as a result of internal role adjustments.	t1098 google_workspace elastic
google workspace administrators may renew a suspended user account if the user is expected to continue employment at the organization after temporary leave. suspended user accounts are typically used by administrators to remove access to the user while actions is taken to transfer important documents and roles to other users, prior to deleting the user account and removing the license.	t1078 google_workspace elastic
google workspace users typically share drive resources with a shareable link where parameters are edited to indicate when it is viewable or editable by the intended recipient. it is uncommon for a user in an organization to manually copy a drive object from an external drive to their corporate drive. this may happen where users find a useful spreadsheet in a public drive, for example, and replicate it to their drive. it is uncommon for the copied object to execute a container-bound script either unless the user was intentionally aware, suggesting the object uses container-bound scripts to accomplish a legitimate task.	t1566 google_workspace elastic
gpo	t1546 t1546.002 windows sigma
group policy objects are created as part of regular administrative operations, filter as needed.	t1078.002 t1484 t1484.001 endpoint splunk
guest user invitations may be sent out by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. guest user invitations from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1078 azure elastic
help desk operator doing backup or re-imaging end user machine or backup software	t1039 zeek windows sigma
help desk or it may need to manually add a corporate root ca on occasion. need to test if gpo push doesn't trigger fp	t1553 t1553.004 windows sigma
high	t1059 t1059.001 t1059.003 t1105 windows sigma
high risk permissions are part of any gcp environment, however it is important to track resource and accounts usage, this search may produce false positives.	t1078 gcp account splunk
highly likely if rar is a default archiver in the monitored environment.	t1560 t1560.001 windows sigma
highly possible server administrators will troubleshoot with ntdsutil.exe, generating false positives.	t1003 t1003.003 endpoint splunk
host connections not using host fqdn.	t1219 windows sigma
host connections to external legitimate domains.	t1219 windows sigma
host connections to valid domains, exclude these.	t1219 windows sigma
host windows firewall planned system administration changes.	t1562 windows elastic
hp software	t1218 t1218.005 windows sigma
http traffic on a non standard port. verify that the destination ip address is not related to a domain controller.	t1558 windows elastic
hyperv or other virtualization technologies with binary not listed in filter portion of detection	t1070 t1070.006 windows sigma
iam users may occasionally share ec2 snapshots with another aws account belonging to the same organization. if known behavior is causing false positives, it can be exempted from the rule.	t1537 aws elastic
icmp packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. as such, it is possible that a large icmp packet could be perfectly legitimate. if large icmp packets are associated with command and control traffic, there will typically be a large number of these packets observed over time. if the search is providing a large number of false positives, you can modify the macro `detect_large_outbound_icmp_packets_filter` to adjust the byte threshold or add specific ip addresses to an allow list.	t1095 endpoint splunk
if a computer is a member of a domain, dpapi has a backup mechanism to allow unprotection of the data. which will trigger this event.	t1003 t1003.004 windows sigma
if a known good domain is not listed in the legit_domains.csv file, then the search could give you false postives. please update that lookup file to filter out dns requests to legitimate domains.	T1566.003 endpoint splunk
if a mfa reset or deactivated was performed by a system administrator.	t1556 t1556.006 okta sigma
if a user requires an anonymising proxy due to valid justifications.	t1562 t1562.006 okta sigma
if an end-user incorrectly identifies normal activity as suspicious.	t1586 t1586.003 okta sigma
if cloud app security identifies, for example, a high rate of file uploads or file deletion activities it may represent an adverse encryption process.	t1486 o365 elastic
if installed on a per-user level, the path would be located in \"appdata\local\". add additional filters to reflect this mode of installation	t1574 t1574.001 t1574.002 windows sigma
if key credentials are regularly assigned to users, these events will need to be tuned out.	t1222 t1222.001 t1550 endpoint splunk
if known behavior is causing false positives, it can be exempted from the rule.	t1053 t1053.003 t1074 t1078 t1552 t1552.007 gcp aws azure sigma
if prevalent in the environment, filter on cns that end in a dollar sign indicating it is a machine name	windows sigma
if prevalent in the environment, filter on events where the accountname and cn of the subject do not reference the same user	windows sigma
if source account name is not an admin then its super suspicious	t1087 t1087.002 windows sigma
if sudoedit is throwing segfaults for other reasons this will pick those up too.	t1068 endpoint splunk
if teamcity is not in use, this analytic will not return results. monitor and tune for your environment.	t1190 web server splunk
if the application expects to work with xml there may be parsing issues that don't necessarily mean xxe.	t1190 jvm sigma
if the behavior of creating okta api tokens is expected, consider adding exceptions to this rule to filter false positives.	t1136 okta elastic
if the behavior of deactivating mfa for okta user accounts is expected, consider adding exceptions to this rule to filter false positives.	t1556 okta elastic
if the behavior of deactivating okta policies is expected, consider adding exceptions to this rule to filter false positives.	t1562 okta elastic
if the behavior of revoking okta api tokens is expected, consider adding exceptions to this rule to filter false positives.	t1531 okta elastic
if the domains listed in this rule are used as part of an authorized workflow, this rule will be triggered by those events. validate that this is expected activity and tune the rule to fit your environment variables.	t1016 t1614 rules_building_block elastic
if the identity_management data model is not updated regularly, this search could give you false positive alerts. please consider this and investigate appropriately.	t1078.002 domain server splunk
if the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed.	t1219 windows sigma
if the source ip is not localhost then it's super suspicious, better to monitor both local and remote changes to gpo scheduled tasks.	t1053 t1053.005 windows sigma
if there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential fps.	t1486 endpoint splunk
if there is a vulnerablility scannner looking for log4shells this will trigger, otherwise likely to have low false positives.	t1133 t1190 endpoint splunk
if this was approved by system administrator or confirmed user action.	t1078 t1078.004 azure sigma
if this was approved by system administrator.	t1078 t1078.004 t1110 t1556 t1556.006 azure sigma
if ws_ftp server is not in use, this analytic will not return results. monitor and tune for your environment. note the metasploit module is focused on only hitting /aht/ and not the full /aht/ahtapiservice.asmx/authuser url.	t1190 web server splunk
if you are seeing more results than desired, you may consider reducing the value for threshold in the search. you should also periodically re-run the support search to re-build the ml model on the latest data.	t1071 t1071.004 endpoint splunk
if you experience a lot of fp you could comment the driver name or its exact known legitimate location (when possible)	t1068 t1543 t1543.003 windows sigma
if you have front-facing proxies that provide authentication and tls, this rule would need to be tuned to eliminate the source ip address of your reverse-proxy.	t1190 network elastic
if you work in a public sector then it may be good to exclude things like endswith \".edu\", \".gov\" and or \".mil\"	t1095 t1571 zeek sigma
igfxcuiservice.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxcuiservice.exe is the parent of the cmd.exe)	t1564 t1564.001 windows sigma
imes are essential for languages that have more characters than can be represented on a standard keyboard, such as chinese, japanese, and korean.	t1562 t1562.001 windows sigma
implementation in regions that use right to left in native language.	t1036 t1036.002 endpoint splunk
in development environment where vscode is used heavily. false positives may occur when developers use task to compile or execute different types of code. remove or add processes accordingly	t1202 t1218 windows sigma
in modern windows systems, unable to see legitimate usage of this process, however, if an organization has legitimate purpose for this there can be false positives.	t1071 t1071.001 windows sigma
in most organizations, device code authentication will be used to access common microsoft service but it may be legitimate for others. filter as needed.	t1528 t1566 t1566.002 azure tenant splunk
in most organizations, domain federation settings will be updated infrequently. filter as needed.	t1484 T1484.002 azure active directory splunk
in most organizations, new customm domains will be updated infrequently. filter as needed.	t1484 T1484.002 azure active directory splunk
in rare administrative cases, this function might be used to check network connectivity	t1059 t1059.001 windows sigma
in rare occasions administrators might leverage livekd to perform live kernel debugging. this should not be allowed on production systems. investigate and apply additional filters where necessary.	windows sigma
in rare occurrences where \"odbcconf\" crashes. it might spawn a \"werfault\" process	t1218 t1218.008 windows sigma
in some cases admin can disable systemrestore on a machine.	t1490 endpoint splunk
in some cases, an automated script or system may enable this setting continuously, leading to false positives. to avoid such situations, it is recommended to monitor the frequency and context of the registry modification and modify or filter the detection rules as needed. this can help to reduce the number of false positives and ensure that only genuine threats are identified. additionally, it is important to investigate any detected instances of this modification and analyze them in the broader context of the system and network to determine if further action is necessary.	t1053.005 endpoint splunk
in the wild, we have observed three different types of attempts that could potentially trigger false positives if the http status code is not in the query. please check this github gist for the specific uris : https://gist.github.com/patel-bhavin/d10830f3f375a2397233f6a4fe38d5c9 . these could be legitimate requests depending on the context of your organization. therefore, it is recommended to modify the analytic as needed to suit your specific environment.	t1190 network splunk
including werfault.exe may cause some unintended false positives related to normal application faulting, but is used in a number of uac bypass techniques.	t1548 t1548.002 endpoint splunk
increase of users in the environment	t1078 azure sigma
initial installation of a domain controller.	t1098 windows sigma
inline scripting can be used by some rare third party applications or administrators. investigate and apply additional filters accordingly	t1059 windows sigma
install or update of a legitimate printing driver. verify the printer driver file metadata such as manufacturer and signature information.	t1068 windows elastic
installation of a service	t1543 t1543.003 windows sigma
installation of legitimate service.	t1543 t1543.002 linux sigma
installation of unsigned packages for testing purposes	windows sigma
installer tools that disable services, e.g. before log collection agent installation	t1070 t1070.001 t1562 t1562.001 windows sigma
installers and updaters may set currently in use files for rename or deletion after a reboot.	t1036 t1036.003 windows sigma
intended exclusions by administrators	t1562 t1562.001 windows sigma
internal or legitimate external domains using dnssec. verify if these are legitimate dnssec domains and then exclude them.	t1095 t1571 zeek sigma
internal vulnerability scanners	t1190 sigma
internal vulnerability scanners can cause some serious fps when used, if you experience a lot of fps due to this think of adding more filters such as \"user agent\" strings and more response codes	t1189 t1190 t1221 sigma
internal vulnerability scanners will trigger this detection.	t1046 t1595.002 endpoint splunk
inventory and monitoring activity	t1190 t1505 t1505.001 sigma
inventory tool runs	t1087 t1087.001 t1087.002 windows sigma
investigate if licenses have expired.	t1078 azure sigma
investigate if potential generic account that cannot be removed.	t1078 azure sigma
investigate if threshold setting in pim is too low.	t1078 azure sigma
investigate if user is performing mfa at sign-in.	t1078 azure sigma
investigate the contents of the \"userinitmprlogonscript\" value to determine of the added script is legitimate	t1037 t1037.001 windows sigma
investigate where if active time period for a role is set too short.	t1078 azure sigma
investigate where users are being assigned privileged roles outside of privileged identity management and prohibit future assignments from there.	t1078 azure sigma
iot (internet of things) devices and networks may use telnet and can be excluded if desired. some business work-flows may use telnet for administration of older devices. these often have a predictable behavior. telnet activity involving an unusual source or destination may be more suspicious. telnet activity involving a production server that has no known associated telnet work-flow or business requirement is often suspicious.	t1021 t1190 network elastic
ipv4-to-ipv6 mapped ips	t1078 t1133 t1190 windows sigma
irc activity may be normal behavior for developers and engineers but is unusual for non-engineering end users. irc activity involving an unusual source or destination may be more suspicious. irc activity involving a production server is often suspicious. because these ports are in the ephemeral range, this rule may false under certain conditions, such as when a nat-ed web server replies to a client which has used a port in the range by coincidence. in this case, these servers can be excluded. some legacy applications may use these ports, but this is very uncommon and usually only appears in local traffic using private ips, which does not match this rule's conditions.	t1048 _deprecated elastic
it is common to see a spike of legitimate failed authentication events on monday mornings.	t1110 T1110.003 endpoint splunk
it is highly possible you will find false positives, however, the base score is set to 2 for _any_ jndi found in raw logs. tune and change as needed, include any filtering.	t1133 t1190 web server splunk
it is highly recommended to baseline your activity and tune out common business use cases.	t1203 windows sigma
it is important to note that false positives may occur if the search criteria are expanded beyond the http status code 200. in other words, if the search includes other http status codes, the likelihood of encountering false positives increases. this is due to the fact that http status codes other than 200 may not necessarily indicate a successful exploitation attempt.	t1190 network splunk
it is important to understand that if you happen to install any new applications on your hosts or are copying a large number of files, you can expect to see a large increase of file modifications.	endpoint splunk
it is likely that the outbound server message block (smb) traffic is legitimate, if the company's internal networks are not well-defined in the assets and identity framework. categorize the internal cidr blocks as `internal` in the lookup file to avoid creating notable events for traffic destined to those cidr blocks. any other network connection that is going out to the internet should be investigated and blocked. best practices suggest preventing external communications of all smb versions and related protocols at the network boundary.	t1071 T1071.002 endpoint splunk
it is not uncommon for outlook to write legitimate zip files to the disk.	t1566 t1566.001 endpoint splunk
it is possible administrative scripts may start/stop/delete services. filter as needed.	t1489 endpoint splunk
it is possible administrators or scripts may run these commands, filtering may be required.	t1059 t1059.001 t1505 t1505.004 t1552 t1552.004 t1562 t1562.002 t1649 endpoint splunk
it is possible administrators or super users will use curl for legitimate purposes. filter as needed.	t1105 endpoint splunk
it is possible certain system management frameworks utilize this command to gather trust information.	t1482 endpoint splunk
it is possible false positives may be present based on the internal name dcinst.exe, filter as needed. it may be worthy to alert on the service name.	t1486 endpoint splunk
it is possible false positives will be present based on third party applications. filtering may be needed.	t1558 endpoint splunk
it is possible for a legitimate file with these extensions to be created. if this is a true ransomware attack, there will be a large number of files created with these extensions.	t1485 endpoint splunk
it is possible for this search to generate a notable event for a batch file write to a path that includes the string \"system32\", but is not the actual windows system directory. as such, you should confirm the path of the batch file identified by the search. in addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. you should confirm that the activity is legitimate and modify the search to add exclusions, as necessary.	t1204 t1204.002 endpoint splunk
it is possible legitimate applications may perform this behavior and will need to be filtered.	t1218 t1218.005 endpoint splunk
it is possible legitimate applications will request access to winlogon, filter as needed.	t1134 t1134.001 endpoint splunk
it is possible legitimate traffic can trigger this rule. please investigate as appropriate. the threshold for generating an event can also be customized to better suit your environment.	t1071 t1071.004 endpoint splunk
it is possible scripts or administrators may trigger this analytic. filter as needed based on parent process, application.	t1053 t1053.005 endpoint splunk
it is possible some administrative utilities will load dismcore.dll outside of normal system paths, filter as needed.	t1574.002 endpoint splunk
it is possible some administrative utilities will load msi.dll outside of normal system paths, filter as needed.	t1574 t1574.002 endpoint splunk
it is possible some agent based products will generate false positives. filter as needed.	t1003 t1003.002 endpoint splunk
it is possible some applications will create a consumer and may be required to be filtered. for tuning, add any additional lolbin's for further depth of coverage.	t1546 t1546.003 endpoint splunk
it is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts.	t1078 t1078.003 windows splunk
it is possible that a user downloaded these files to use them locally and there are aws services in configured that perform these activities for a legitimate reason. filter is needed.	t1119 aws account splunk
it is possible that an admin will create a new system using a new instance type never used before. verify with the creator that they intended to create the system with the new instance type.	aws instance splunk
it is possible that an administrator created and deleted an account in a short time period. verifying activity with an administrator is advised.	t1078.003 t1136 t1136.001 windows splunk
it is possible that an administrator created the account. verifying activity with an administrator is advised. this analytic is set to anomaly to allow for risk to be added. filter and tune as needed. restrict to critical infrastructure to reduce any volume.	t1136 t1136.001 endpoint splunk
it is possible that an aws admin has legitimately implemented data replication to ensure data availability and improve data protection/backup strategies.	t1537 ec2 snapshot splunk
it is possible that an aws admin has legitimately shared a snapshot with an other account for a specific purpose. please check any recent change requests filed in your organization.	t1537 ec2 snapshot splunk
it is possible that an aws admin has legitimately shared a snapshot with others for a specific purpose.	t1537 ec2 snapshot splunk
it is possible that an aws administrator has legitimately created this task for creating backup. please check the `sourcelocationarn` and `destinationlocationarn` of this task	t1119 aws account splunk
it is possible that an aws administrator has legitimately disabled versioning on certain buckets to avoid costs.	t1490 aws account splunk
it is possible that an aws administrator or a user has legitimately created this job for some tasks.	t1119 aws account splunk
it is possible that legitimate remote access software is used within the environment. ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content	t1219 network endpoint splunk
it is possible that legitimate scripts or network administrators may enable powershell web access. monitor and escalate as needed.	t1059.001 endpoint splunk
it is possible that legitimate user/admin may modify a number of security groups	T1578.005 cloud instance splunk
it is possible that list of dynamic dns providers is outdated and/or that the url being requested is legitimate.	t1071.001 endpoint splunk
it is possible that other utilities or system processes may legitimately write to this folder. investigate and modify the search to include exceptions as appropriate.	t1036 windows splunk
it is possible that some accounts do not have mfa enabled for the aws account however its agaisnt the best practices of securing aws.	t1078 t1078.004 t1586 t1586.003 aws account splunk
it is possible that the user has legitimately added a new device to their account. please verify this activity.	t1098 t1098.005 okta tenant splunk
it is possible that there are legitimate user roles making new or infrequently used api calls in your infrastructure, causing the search to trigger.	t1078.004 aws instance splunk
it is possible that these logs may be legitimately cleared by administrators. filter as needed.	t1070 t1070.001 endpoint splunk
it is possible that your vulnerability scanner is not detecting that the patches have been applied.	endpoint splunk
it is possible the event logging service gets shut down due to system errors or legitimately administration tasks. filter as needed.	t1070 t1070.001 endpoint splunk
it is possible there will be false positives, filter as needed.	t1059 t1059.001 t1115 endpoint splunk
it is possible third party applications may add these spns to computer accounts, filtering may be needed.	t1558 endpoint splunk
it is possible third party applications may have a computer account that adds computer accounts, filtering may be required.	t1558 endpoint splunk
it is possible to start this detection will need to be tuned by source ip or user. in addition, change the count values to an upper threshold to restrict false positives.	t1580 aws account splunk
it is rare to see instances of infotech storage handlers being used, but it does happen in some legitimate instances. filter as needed.	t1218 t1218.001 endpoint splunk
it is uncommon for a user to log in from multiple cities simultaneously, which may indicate a false positive.	t1586.003 okta tenant splunk
it is uncommon for normal users to execute a series of commands used for network discovery. system administrators often use scripts to execute these commands. these can generate false positives.	t1016 endpoint splunk
it is unusual for a service to be created or modified by directly manipulating the registry. however, there may be legitimate instances of this behavior. it is important to validate and investigate, as appropriate.	t1574 t1574.011 endpoint splunk
it is unusual for netsh.exe to have any child processes in most environments. it makes sense to investigate the child process and verify whether the process spawned is legitimate. we explicitely exclude \"c:\program files\rempl\sedlauncher.exe\" process path since it is a legitimate process by mircosoft.	t1562.004 endpoint splunk
it is unusual to turn this feature off a windows system since it is a default security control, although it is not rare for some policies to disable it. although no false positives have been identified, use the provided filter macro to tune the search.	t1562 t1562.001 endpoint splunk
it or network admin may create an document automation that will run shell script.	t1566 t1566.001 endpoint splunk
it's likely that you'll find activity detected by users/service accounts that are not listed in the `identity_lookup_expanded` or ` aws_service_accounts.csv` file. if the user is a legitimate service account, update the `aws_service_accounts.csv` table with that entry.	t1078.004 aws instance splunk
it's not an uncommon to use te.exe directly to execute legal taef tests	t1218 windows sigma
it's possible for a legitimate file to be created with the same name as one noted in the lookup file. filenames listed in the lookup file should be unique enough that collisions are rare. looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate.	endpoint splunk
it's possible for legitimate administrative actions or automated processes to trigger this detection, especially if there are bulk modifications to okta idp lifecycle events. review the context of the modification, such as the user making the change and the specific lifecycle event modified, to determine if it aligns with expected behavior.	t1087.004 okta tenant splunk
it's possible for legitimate http requests to be made to urls containing the suspicious paths.	t1082 t1133 web server splunk
it's possible for system administrators to write scripts that exhibit this behavior. if this is the case, the search will need to be modified to filter them out.	t1112 endpoint splunk
it's possible that a legitimate file could be created with the same name used by ransomware note files.	t1485 endpoint splunk
it's possible that a new user will start to modify ec2 instances when they haven't before for any number of reasons. verify with the user that is modifying instances that this is the intended behavior.	t1078 t1078.004 aws instance splunk
it's possible that a user has legitimately deleted a network acl.	t1562 t1562.007 instance aws instance splunk
it's possible that a user has unknowingly started an instance in a new region. please verify that this activity is legitimate.	T1535 aws instance cloud compute instance splunk
it's possible that a user will start to create compute instances for the first time, for any number of reasons. verify with the user launching instances that this is the intended behavior.	t1078 t1078.004 cloud compute instance splunk
it's possible that a user will start to create ec2 instances when they haven't before for any number of reasons. verify with the user that is launching instances that this is the intended behavior.	t1078.004 aws instance splunk
it's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts.	t1078 t1078.002 windows splunk
it's possible that an admin has created this acl with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.	t1562 t1562.007 aws instance splunk
it's possible that an enterprise has more than five dns servers that are configured in a round-robin rotation. please customize the search, as appropriate.	t1048.003 endpoint splunk
it's possible that legitimate traffic will have long urls or long user agent strings and that common sql commands may be found within the url. please investigate as appropriate.	t1190 database server splunk
it's possible that legitimate txt record responses can be long enough to trigger this search. you can modify the packet threshold for this search to help mitigate false positives.	t1048.003 endpoint splunk
it's possible that normal dns traffic will exhibit this behavior. if an alert is generated, please investigate and validate as appropriate. the threshold can also be modified to better suit your environment.	t1048.003 endpoint splunk
it's possible there can be long domain names that are legitimate.	t1048 t1048.003 endpoint splunk
it's recommended that you rotate your access keys periodically to help keep your storage account secure. normal key rotation can be exempted from the rule. an abnormal time frame and/or a key rotation from unfamiliar users, hosts, or locations should be investigated.	t1528 azure elastic
it's strongly recommended that the root user is not used for everyday tasks, including the administrative ones. verify whether the ip address, location, and/or hostname should be logging in as root in your environment. unfamiliar root logins should be investigated immediately. if known behavior is causing false positives, it can be exempted from the rule.	t1078 aws elastic
java scripts and css files	t1190 sigma
java tools are known to produce false-positive when loading libraries	t1059 t1059.003 windows sigma
javascripts,css files and png files	t1189 sigma
jobs and services started with cmd	t1134 t1134.001 t1134.002 windows sigma
key being modified or deleted may be performed by a system administrator.	t1552 t1552.001 azure sigma
key modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1552 t1552.001 azure sigma
key vault being modified or deleted may be performed by a system administrator.	t1552 t1552.001 azure sigma
key vault modifications may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. key vault modifications from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1552 azure elastic
key vault modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1552 t1552.001 azure sigma
known applications running from these locations for legitimate purposes. targeting only kerberos (port 88) may significantly reduce noise.	t1087 t1087.002 t1204 t1204.002 endpoint splunk
known false positive caused with python anaconda	t1027 t1027.002 windows sigma
known legacy accounts	t1078 t1078.004 t1110 azure sigma
known or approved applications used by the organization or usage of built-in functions. known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content	t1219 endpoint splunk
known or internal account ids or automation	T1530 t1580 T1657 aws elastic
known updates by administrators.	azure sigma
kubectl calls are not malicious by nature. however source ip, source user, user agent, object path, and authorization context can reveal potential malicious activity, specially anonymous suspicious ips and sensitive objects such as configmaps or secrets	gcp gke kubernetes cluster splunk
kubectl calls are not malicious by nature. however source ip, verb and object can reveal potential malicious activity, specially suspicious ips and sensitive objects such as configmaps or secrets	azure aks kubernetes cluster splunk
kubernetes cluster being created or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
kubernetes cluster created or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
lambda function owners may add layers to their functions for legitimate purposes.	T1648 aws elastic
lambda function owners may legitimately update the function policy to allow public invocation.	t1546 aws elastic
lambda layer being attached from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	aws sigma
lambda layer being attached may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	aws sigma
landesk ldclient ivanti-psmodule (ps encodedcommand)	t1070 t1490 windows sigma
legacy applications.	t1558 t1558.003 windows sigma
legacy hosts	t1550 t1550.002 windows sigma
legit administrative action	t1078 azure sigma
legit administrative pim setting configuration changes	t1078 t1078.004 azure sigma
legit application crash with rare werfault commandline value	t1036 windows elastic
legit usage of scripts	t1218 windows sigma
legitamate access by security administators for incident response measures.	t1114 T1114.002 t1567 o365 tenant splunk
legitimate \".bat\", \".hta\", \".ps1\" or \".vbs\" scripts leverage legitimately often. apply additional filter and exclusions as necessary	t1218 t1218.010 windows sigma
legitimate \".xbap\" being executed via \"presentationhost\"	t1218 windows sigma
legitimate aad health ad fs service instances being deleted in a tenant	t1578 t1578.003 azure sigma
legitimate activities	t1027 t1049 t1083 t1490 t1518 t1518.001 t1553 t1553.001 t1562 t1562.001 macos linux sigma
legitimate activity by administrators and scripts	t1021 t1021.002 windows sigma
legitimate activity is expected since compressing files with a password is common.	t1560 t1560.001 windows sigma
legitimate activity of system administrators	t1219 windows linux sigma
legitimate ad fs servers added to an aad health ad fs service instance	t1578 azure sigma
legitimate add-ins	t1137 t1137.006 windows sigma
legitimate addin installation	t1137 t1137.006 windows sigma
legitimate addition of logon scripts via the command line by administrators or third party tools	t1037 t1037.001 windows sigma
legitimate admin activity	t1003 t1003.003 t1018 t1069 t1069.002 t1087 t1087.002 t1482 t1562 t1562.004 windows linux sigma
legitimate admin or third party scripts used for diagnostic collection might generate some false positives	t1218 windows sigma
legitimate admin or third party scripts. baseline according to your environment	t1547 t1547.001 windows sigma
legitimate admin script	t1070 t1070.006 t1112 t1562 t1562.001 windows sigma
legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often	t1033 windows sigma
legitimate admin usage	t1003 t1003.003 windows sigma
legitimate administration	t1562 t1562.001 windows sigma
legitimate administration activities	t1007 t1016 t1018 t1033 t1037 t1037.005 t1040 t1046 t1053 t1053.002 t1053.003 t1069 t1069.001 t1070 t1070.002 t1070.004 t1078 t1078.003 t1082 t1087 t1087.001 t1090 t1105 t1136 t1136.001 t1140 t1201 t1518 t1518.001 t1546 t1546.014 t1548 t1548.001 t1552 t1552.001 t1553 t1553.004 t1555 t1555.001 t1562 t1562.004 t1564 t1564.002 t1565 t1565.001 t1592 t1592.004 windows macos linux sigma
legitimate administration activities is expected to trigger false positives. investigate the command line being passed to determine if the service or launch agent are suspicious.	t1543 t1543.001 t1543.004 t1569 t1569.001 macos sigma
legitimate administration activity	t1016 t1018 t1040 t1090 t1482 t1562 t1562.004 windows sigma
legitimate administration activity to troubleshoot network issues	t1040 windows sigma
legitimate administration and backup scripts	windows sigma
legitimate administration and tuning scripts that aim to add functionality to a user powershell session	t1546 t1546.013 windows sigma
legitimate administration script	t1059 t1059.003 windows sigma
legitimate administration scripts	windows sigma
legitimate administration tools and activities	t1056 t1056.002 macos sigma
legitimate administration use	t1543 t1543.003 windows sigma
legitimate administration use but user and host must be investigated	t1016 t1482 windows sigma
legitimate administrative action	t1564 windows sigma
legitimate administrative actions by authorized system administrators could cause this alert. verify the user identity, user agent, and hostname to ensure they are expected.	t1078 t1078.004 t1531 aws sigma
legitimate administrative actions by authorized users importing keys for valid purposes.	t1078 aws sigma
legitimate administrative activities	t1082 t1098 t1497 t1497.001 t1562 t1562.001 t1562.003 gcp macos linux sigma
legitimate administrative activities changing the access levels for an application	t1098 t1098.003 gcp sigma
legitimate administrative activity	t1484 t1547 windows elastic
legitimate administrative activity related to shadow copies.	t1003 windows elastic
legitimate administrative script	t1059 t1059.001 t1098 t1132 t1132.001 t1136 t1136.002 t1553 t1553.004 t1571 t1573 t1574 t1574.011 t1574.012 windows sigma
legitimate administrative scripts	t1059 t1059.005 windows sigma
legitimate administrative scripts may use this functionality. use \"parentimage\" in combination with the script names and allowed users and applications to filter legitimate executions	t1132 t1132.001 windows sigma
legitimate administrative tasks	t1003 t1003.005 windows sigma
legitimate administrative use	t1046 t1082 t1135 t1505 t1505.005 t1546 t1546.007 t1546.008 t1547 t1547.001 t1547.002 t1547.010 t1547.014 t1556 t1556.002 t1557 t1562 t1562.002 t1564 t1564.002 t1574 t1574.007 windows sigma
legitimate administrative use (should be investigated either way)	t1562 t1562.001 windows sigma
legitimate administrator activities	t1531 linux sigma
legitimate administrator activity	t1021 t1021.002 t1021.004 t1046 t1490 t1505 t1505.004 t1562 t1562.002 t1569 t1569.002 windows macos sigma
legitimate administrator activity restoring a file	t1562 t1562.001 windows sigma
legitimate administrator deletes shadow copies using operating systems utilities for legitimate reason	t1070 t1490 windows sigma
legitimate administrator or developer creating legitimate executable files in a web application folder	t1505 t1505.003 windows sigma
legitimate administrator or user creates a service for legitimate reasons.	t1543 t1543.003 windows sigma
legitimate administrator or user enumerates local users for legitimate reason	t1033 t1087 t1087.001 windows sigma
legitimate administrator or user executes a service for legitimate reasons.	t1569 t1569.002 windows sigma
legitimate administrator or user uses network sniffing tool for legitimate reasons.	t1040 linux sigma
legitimate administrator sets up autorun keys for legitimate reason	t1546 t1546.009 t1547 t1547.001 windows sigma
legitimate administrator sets up autorun keys for legitimate reasons.	t1547 t1547.001 windows sigma
legitimate administrator usage	t1218 windows sigma
legitimate administrator usage of vssadmin or wmic will create false positives.	t1003 t1003.003 endpoint splunk
legitimate administrator usage of wmic to create a shadow copy.	t1003 t1003.003 endpoint splunk
legitimate administrator using credential dumping tool for password recovery	t1003 t1003.001 t1003.002 t1003.004 t1003.005 t1003.006 t1569 t1569.002 windows sigma
legitimate administrator using tool for password recovery	t1003 t1003.001 t1003.002 t1003.003 t1003.004 t1003.005 windows sigma
legitimate administrator working with shadow copies, access for backup purposes	t1003 t1003.002 t1003.003 windows sigma
legitimate administrators granting over permissive permissions to users	t1218 windows sigma
legitimate administrators may run these commands	t1053 t1070 t1070.003 t1490 t1505 t1565 t1565.002 cisco sigma
legitimate administrators may run these commands, though rarely.	t1495 t1529 t1565 t1565.001 cisco sigma
legitimate administrators might create an \"esx admins\" group for valid reasons. verify that the group creation is authorized and part of normal administrative tasks. consider the context of the action, such as the user performing it and any related activities.	t1136.001 t1136.002 endpoint splunk
legitimate administrators might create, delete, or modify an \"esx admins\" group for valid reasons. verify that the group changes are authorized and part of normal administrative tasks. consider the context of the action, such as the user performing it and any related activities.	t1136.001 t1136.002 endpoint splunk
legitimate administrators might create, delete, or modify an a privileged group for valid reasons. verify that the group changes are authorized and part of normal administrative tasks. consider the context of the action, such as the user performing it and any related activities.	t1136.001 t1136.002 endpoint splunk
legitimate administrators might use this command to remove sysmon for debugging purposes	t1562 t1562.001 windows sigma
legitimate administrators might use this command to update sysmon configuration.	t1562 t1562.001 windows sigma
legitimate administrators removing applications (should always be investigated)	t1562 t1562.001 windows sigma
legitimate allowlisting of noisy accounts	t1562 o365 elastic
legitimate and authorized user creation	okta sigma
legitimate any requests may trigger this search, however it is unusual to see a large volume of them under typical circumstances. you may modify the threshold in the search to better suit your environment.	t1498 T1498.002 dns servers splunk
legitimate application and websites that use windows paths in their url	t1505 t1505.003 sigma
legitimate application requesting certificate exports will trigger this. apply additional filters as needed	t1649 windows sigma
legitimate application that needs to do a full dump of their process	t1003 t1003.001 windows sigma
legitimate applications	t1190 t1505 t1505.001 sigma
legitimate applications communicating with the \"api.notion.com\" endpoint that are not already in the exclusion list. the desktop and browser applications do not appear to be using the api by default unless integrations are configured.	t1102 windows sigma
legitimate applications communicating with the \"googleapis.com\" endpoints that are not already in the exclusion list. this is environmental dependent and requires further testing and tuning.	t1102 windows sigma
legitimate applications communicating with the telegram api e.g. web browsers not in the exclusion list, app with an rss etc.	t1102 windows sigma
legitimate applications loading their own versions of the dll mentioned in this rule.	t1574 t1574.002 windows sigma
legitimate applications loading their own versions of the dlls mentioned in this rule	t1574 t1574.001 t1574.002 windows sigma
legitimate applications making use of this feature for compatibility reasons	t1546 t1546.011 windows sigma
legitimate applications may access multiple mailboxes via an api. you can filter by the clientappid or the clientipaddress fields.	T1114.002 o365 tenant splunk
legitimate applications may be granted tenant wide consent, filter as needed.	t1098 t1098.003 azure tenant o365 tenant splunk
legitimate applications may install services with uncommon services paths.	t1543 t1543.003 t1569 t1569.002 endpoint splunk
legitimate applications may obtain a handle for winlogon.exe. filter as needed	t1550 t1550.003 endpoint splunk
legitimate applications may spawn powershell as a child process of the the identified processes. filter as needed.	t1021 t1021.003 t1021.006 t1047 t1053.005 t1059.001 T1218.014 t1543.003 endpoint splunk
legitimate applications may trigger this behavior, filter as needed.	t1021 t1021.003 t1021.006 t1047 t1053 t1053.005 T1218.014 t1543 t1543.003 endpoint splunk
legitimate applications may use random scheduled task names.	t1053 t1053.005 endpoint splunk
legitimate applications may use random windows service names.	t1543 t1543.003 endpoint splunk
legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)	t1546 t1546.012 windows sigma
legitimate applications writing events via this cmdlet. investigate alerts to determine if the action is benign	windows sigma
legitimate apps	t1190 sigma
legitimate apps the use these paths	t1190 sigma
legitimate appx packages not signed by ms used part of an enterprise	windows sigma
legitimate assembly compilation using a build provider	windows sigma
legitimate atera agent installation	t1219 windows sigma
legitimate audio capture by legitimate user.	t1123 windows sigma
legitimate authorized activity.	azure sigma
legitimate backup activity from administration scripts and software.	t1490 windows sigma
legitimate backup operation by authorized administrators. matches must be investigated and allowed on a case by case basis.	t1003 t1003.003 windows sigma
legitimate backup operation/creating shadow copies	t1003 t1003.003 windows sigma
legitimate browser install, update and recovery scripts	t1059 t1189 t1203 macos sigma
legitimate calls to system binaries	windows sigma
legitimate cases in which archives contain iso or img files and the user opens the archive and the image via clicking and not extraction	t1566 windows sigma
legitimate certificate exports by administrators. additional filters might be required.	t1059 t1059.001 t1552 t1552.004 windows sigma
legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)	t1003 t1003.001 windows sigma
legitimate changes to lambda functions can trigger this signal. ensure that the changes are authorized and align with your organization's policies.	T1648 rules_building_block elastic
legitimate changes to share an s3 bucket with an external account may be identified as false positive but are not best practice.	t1537 aws elastic
legitimate changes to the 'risk-based step-up consent' setting by administrators, perhaps as part of a policy update or security assessment, may trigger this alert, necessitating verification of the change's intent and authorization	t1562 azure tenant splunk
legitimate cmstp use (unlikely in modern enterprise environments)	t1218 t1218.003 t1548 t1548.002 t1559 t1559.001 windows sigma
legitimate commands in .lnk files	t1059 t1059.001 windows sigma
legitimate creation of a new admin role assignment	okta sigma
legitimate creation of an api token by authorized users	okta sigma
legitimate crypto coin mining	t1496 t1567 sigma
legitimate custom shim installations will also trigger this rule	t1546 t1546.011 t1547 t1547.009 windows sigma
legitimate data export operations.	t1048 windows sigma
legitimate deactivation by administrative staff	t1070 t1070.001 t1562 t1562.001 windows sigma
legitimate debugging activity. investigate the identity performing the requests and their authorization.	t1609 kubernetes sigma
legitimate deinstallation by administrative staff	t1562 t1562.001 windows sigma
legitimate deletion of route53 resolver query log configuration by authorized personnel.	t1562 aws elastic
legitimate deployment of anydesk	t1219 windows sigma
legitimate disabling of crashdumps	t1112 t1564 windows sigma
legitimate dlls being registered via \"odbcconf\" will generate false positives. investigate the path of the dll and its content to determine if the action is authorized.	t1218 t1218.008 windows sigma
legitimate dns activity can be detected in this search. investigate, verify and update the list of authorized dns servers as appropriate.	t1071.004 endpoint splunk
legitimate dns changes can be detected in this search. investigate, verify and update the list of provided current answers for the domains in question as appropriate.	t1071.004 endpoint splunk
legitimate dns queries and usage of mega	t1567 t1567.002 windows sigma
legitimate dns queries and usage of put.io	windows sigma
legitimate downloads of \".vhd\" files would also trigger this	t1587 t1587.001 windows sigma
legitimate downloads of files in the tmp folder.	t1105 linux sigma
legitimate downloads via scripting or command-line tools (investigate to determine if it's legitimate)	windows sigma
legitimate driver altitude change to hide sysmon	t1562 t1562.001 windows sigma
legitimate driver dlls being registered via \"odbcconf\" will generate false positives. investigate the path of the dll and its contents to determine if the action is authorized.	t1218 t1218.008 windows sigma
legitimate enable/disable of the setting	windows sigma
legitimate enabling of the old tls versions due to incompatibility	windows sigma
legitimate event consumers	t1546 t1546.003 windows sigma
legitimate exchange system administration activity.	t1005 t1059 t1098 t1114 windows elastic
legitimate execution by system administrators.	t1484 t1484.001 t1547 windows sigma
legitimate execution of custom scripts or commands by jamf administrators. apply additional filters accordingly	macos sigma
legitimate execution of dxcap.exe by legitimate user	t1218 windows sigma
legitimate export of keys	t1012 windows sigma
legitimate extension of domain structure	t1098 windows sigma
legitimate file downloads from a websites and web services that uses the \".zip\" top level domain.	windows sigma
legitimate files reported by the users	t1566 o365 elastic
legitimate files with these rare hacktool names	t1557 t1557.001 windows sigma
legitimate helper added by different programs and the os	t1546 t1546.007 windows sigma
legitimate iam administrators may attach customer-managed policies to roles for various reasons, such as granting temporary permissions or updating existing policies. ensure that the user attaching the policy is authorized to do so and that the action is expected.	t1548 aws elastic
legitimate import of keys	t1112 windows sigma
legitimate incoming connections (e.g. sysadmin activity). most of the time i would expect outgoing connections (initiated locally).	t1219 windows sigma
legitimate installation of a new screensaver	t1218 t1218.011 windows sigma
legitimate installation of code-tunnel as a service	t1071 t1071.001 windows sigma
legitimate installation of new application.	t1204 t1204.002 windows sigma
legitimate installation of printer driver qms 810, texas instruments microlaser printer (unlikely)	t1204 windows sigma
legitimate installations of exchange transportagents. assemblypath is a good indicator for this.	t1505 t1505.002 windows sigma
legitimate internal requirements.	t1112 windows sigma
legitimate java applications may use perform outbound connections to these ports. filter as needed	t1133 t1190 endpoint splunk
legitimate local user creations may be done by a system or network administrator. verify whether this is known behavior in your environment. local user creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1136 windows elastic
legitimate logon activity by authorized ntlm systems may be detected by this search. please investigate as appropriate.	t1550 t1550.002 endpoint splunk
legitimate logon attempts over the internet	t1078 t1133 t1190 windows sigma
legitimate logon scripts or custom shells may trigger false positives. apply additional filters accordingly.	t1037 t1037.001 windows sigma
legitimate macro files downloaded from the internet	t1566 t1566.001 windows sigma
legitimate macro files sent as attachments via emails	t1566 t1566.001 windows sigma
legitimate macro usage. add the appropriate filter according to your environment	t1204 t1204.002 windows sigma
legitimate manual or automated snapshots created for backups can trigger this rule. ensure that the snapshots are authorized and align with your organization's policies.	t1578 rules_building_block elastic
legitimate mega installers and utilities are expected to communicate with this domain. exclude hosts that are known to be allowed to use this tool.	t1567 t1567.001 windows sigma
legitimate microsoft diagcab	windows sigma
legitimate microsoft software - https://twitter.com/gabriele_pippi/status/1206907900268072962	t1027 t1027.004 windows sigma
legitimate misunderstanding by users on accessing the bedrock models.	aws_bedrock elastic
legitimate misunderstanding by users or overly strict policies	aws_bedrock elastic
legitimate modification of crontab	t1053 t1053.003 linux sigma
legitimate modification of keys	t1112 windows sigma
legitimate modification of screensaver	t1546 t1546.002 windows sigma
legitimate modification of the registry key by legitimate program	t1112 windows sigma
legitimate mssql server actions	t1003 t1003.001 windows sigma
legitimate ncat use	t1095 windows sigma
legitimate need for regback feature by administrators.	t1113 windows sigma
legitimate network diagnostic scripts.	t1040 windows sigma
legitimate new account creation by authorized administrators will generate similar log entries. however, those should include proper authentication details. verify any detected events against expected administrative activities and authorized user lists.	t1190 web application splunk
legitimate new entry added by windows	windows sigma
legitimate openvpn tap installation	t1048 windows sigma
legitimate or intentional inbound connections from public ip addresses on the smb port.	t1078 t1110 t1133 windows sigma
legitimate os functions called by vendor applications, baseline the environment and filter before enabling. recommend throttle by dest/process_name	t1505 t1505.003 endpoint splunk
legitimate overwrite of files.	t1485 linux sigma
legitimate package hosted on a known and authorized remote location	windows sigma
legitimate packages that make use of external binaries such as windows terminal	windows sigma
legitimate piping of the password to anydesk	t1219 windows sigma
legitimate ports redirect	t1562 t1562.004 linux sigma
legitimate powershell scripts	t1003 t1003.003 t1003.006 t1033 t1036 t1036.003 t1057 t1070 t1070.003 t1083 t1201 t1546 t1546.015 t1553 t1553.005 t1562 t1562.001 t1564 t1564.006 t1615 windows sigma
legitimate powershell scripts that disable windows defender for troubleshooting purposes. must be investigated.	t1562 t1562.001 windows sigma
legitimate powershell scripts that make use of psreflect to access the win32 api	t1059 t1106 windows elastic
legitimate powershell scripts that make use of these functions.	t1039 t1055 t1059 t1069 t1087 t1106 t1135 t1482 windows elastic
legitimate powershell scripts which makes use of compression and encoding.	t1027 t1059 t1140 windows elastic
legitimate powershell scripts which makes use of encryption.	t1027 t1140 windows elastic
legitimate powershell web access installations by administrators	t1059 t1059.001 t1548 t1548.002 windows sigma
legitimate process can have this combination of command-line options, but it's not common.	t1059 t1059.001 endpoint splunk
legitimate process that are not in the exception list may trigger this event.	t1218 t1218.003 endpoint splunk
legitimate processes may be spawned from the microsoft exchange server unified messaging (um) service. if known processes are causing false positives, they can be exempted from the rule.	t1190 t1210 windows elastic
legitimate processes that run at logon. filter according to your environment	t1053 t1053.005 windows sigma
legitimate programs and administrators will execute sc.exe with the start disabled flag. it is possible, but unlikely from the telemetry of normal windows operation we observed, that sc.exe will be called more than seven times in a short period of time.	t1562 t1562.001 endpoint splunk
legitimate programs can also use command-line arguments to execute. please verify the command-line arguments to check what command/program is being executed. we recommend customizing the `first_time_seen_cmd_line_filter` macro to exclude legitimate parent_process_name	t1059.001 t1059.003 endpoint splunk
legitimate publicly shared files from google drive.	t1105 cross-platform elastic
legitimate py2exe binaries	t1027 t1027.002 windows sigma
legitimate python scripts using the socket library or similar will trigger this. apply additional filters and perform an initial baseline before deploying.	t1046 windows sigma
legitimate rclone usage	t1567 t1567.002 windows sigma
legitimate rdp connections from authorized administrators and users will generate these events. to reduce false positives, you should baseline normal rdp connection patterns in your environment, whitelist expected rdp connection chains between known administrative workstations and servers, and track authorized remote support sessions.	t1133 endpoint splunk
legitimate reconfiguration of service.	t1543 t1543.002 linux sigma
legitimate registration of ifilters by the os or software	windows sigma
legitimate remote account administration.	t1098 t1531 windows elastic
legitimate remote administration activity	t1550 windows sigma
legitimate remote alteration of a printer driver.	zeek sigma
legitimate remote share creation	rpc_firewall sigma
legitimate router connections may appear as new connections	endpoint splunk
legitimate scheduled jobs may be created during installation of new software.	t1053 windows elastic
legitimate scheduled tasks may be created during installation of new software.	t1053 t1059 t1218 windows elastic
legitimate scheduled tasks running third party software.	t1053 windows elastic
legitimate script	t1018 t1021 t1021.006 t1048 t1059 t1218 t1218.007 t1562 t1562.001 windows sigma
legitimate script that disables the command history	t1070 t1070.003 windows sigma
legitimate script work	t1027 t1027.001 macos sigma
legitimate scripts	t1105 windows sigma
legitimate scripts that use iex	t1059 t1059.001 windows sigma
legitimate security products adding their own amsi providers. filter these according to your environment	windows sigma
legitimate shell scripts in the \"profile.d\" directory could be common in your environment. apply additional filter accordingly via \"image\", by adding specific filenames you \"trust\" or by correlating it with other events.	linux sigma
legitimate sip being registered by the os or different software.	t1553 t1553.003 windows sigma
legitimate software (un)installations are known to cause some false positives. please add them as a filter when encountered	t1112 windows sigma
legitimate software accessing lsass process for legitimate reason; update the whitelist with it	t1003 t1003.001 windows sigma
legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons.	t1547 t1547.001 windows sigma
legitimate software creating script event consumers	t1546 t1546.003 windows sigma
legitimate software from program files - https://twitter.com/gn3mes1s/status/1206874118282448897	t1027 t1027.004 windows sigma
legitimate software installed by the users for example in the \"appdata\" directory may access these files (for any reason).	t1003 windows sigma
legitimate software installed on partitions other than \"c:\\"	t1003 windows sigma
legitimate software naming their tasks as guids	t1053 t1053.005 windows sigma
legitimate software or scripts using cron jobs for recurring tasks.	t1053 _deprecated elastic
legitimate software such as av and edr	t1003 t1003.001 windows sigma
legitimate software that uses these patterns	t1036 t1059 t1059.004 t1140 linux sigma
legitimate software uses the scripts (preinstall, postinstall)	t1059 t1059.007 t1071 t1071.001 macos sigma
legitimate software using python dlls	t1574 t1574.002 windows sigma
legitimate software, cleaning hist file	t1552 t1552.003 macos linux sigma
legitimate sub processes started by manage engine servicedesk pro	t1102 windows sigma
legitimate system administration	t1047 windows sigma
legitimate system administrator usage of these commands	t1082 linux sigma
legitimate testing of microsoft ui parts.	t1218 windows sigma
legitimate third party application located in \"appdata\" may leverage this dll to offer 7z compression functionality and may generate false positives. apply additional filters as needed.	t1574 t1574.001 t1574.002 windows sigma
legitimate tools that accidentally match on the searched patterns	t1059 windows sigma
legitimate usage by an administrator	windows sigma
legitimate usage by software developers	t1072 t1218 windows sigma
legitimate usage by software developers/testers	t1003 t1003.001 t1218 windows sigma
legitimate usage by some scripts might trigger this as well	windows sigma
legitimate usage for administration purposes	t1003 t1003.005 t1218 windows sigma
legitimate usage for debugging purposes	windows sigma
legitimate usage for tracing and diagnostics purposes	t1218 windows sigma
legitimate usage of \".diagcab\" files	t1202 windows sigma
legitimate usage of \".one\" or \".onepkg\" files from those locations	windows sigma
legitimate usage of \".pub\" files from those locations	windows sigma
legitimate usage of \"troubleshootingpack\" cmdlet for troubleshooting purposes	t1202 windows sigma
legitimate usage of adplus for debugging purposes	t1003 t1003.001 windows sigma
legitimate usage of appcmd to add new url rewrite rules	windows sigma
legitimate usage of bitlockertogo.exe to encrypt portable devices.	t1218 windows sigma
legitimate usage of chflags by administrators and users.	t1105 t1218 t1552 t1552.001 t1564 t1564.004 macos sigma
legitimate usage of cloudflare quick tunnel	t1090 t1090.001 windows sigma
legitimate usage of cloudflared portable versions	t1090 t1090.001 windows sigma
legitimate usage of cloudflared tunnel.	t1090 t1102 t1572 windows sigma
legitimate usage of cloudflared.	t1090 t1102 t1572 windows sigma
legitimate usage of dsinternals for administration or audit purpose.	t1059 t1059.001 windows sigma
legitimate usage of hdiutil by administrators and users.	t1560 t1560.001 t1566 t1566.001 macos sigma
legitimate usage of internal automation or scripting, especially powershell.exe or pwsh.exe, internal to internal or logon scripts. it may be necessary to omit internal ip ranges if extremely noisy. ie not dest_ip in (\"10.0.0.0/8\",\"172.16.0.0/12\",\"192.168.0.0/16\",\"170.98.0.0/16\",\"0:0:0:0:0:0:0:1\")	t1105 t1218 t1567 endpoint splunk
legitimate usage of ip lookup services such as ipify api	t1590 windows sigma
legitimate usage of livekd for debugging purposes will also trigger this	windows sigma
legitimate usage of nscurl by administrators and users.	t1105 macos sigma
legitimate usage of remote file encryption	rpc_firewall sigma
legitimate usage of remote powershell, e.g. for monitoring purposes.	t1021 t1021.006 t1059 t1059.001 windows sigma
legitimate usage of remote powershell, e.g. remote administration and monitoring.	t1021 t1021.006 t1059 t1059.001 windows sigma
legitimate usage of sdelete	t1027 t1027.005 t1070 t1070.004 t1485 t1553 t1553.002 windows sigma
legitimate usage of stordiag.exe.	t1218 windows sigma
legitimate usage of system.net.networkinformation.ping class	t1048 t1048.003 windows sigma
legitimate usage of teamviewer	t1133 windows macos linux sigma
legitimate usage of the anydesk tool	windows sigma
legitimate usage of the applications from the windows store	windows sigma
legitimate usage of the big ip rest api to execute command for administration purposes	t1190 sigma
legitimate usage of the capabilities by administrators or users. add additional filters accordingly.	windows sigma
legitimate usage of the cmdlet to forward emails	windows sigma
legitimate usage of the features listed in the rule.	windows sigma
legitimate usage of the file by hardware manufacturer such as lenovo (thanks @0gtweet for the tip)	t1542 t1542.001 windows sigma
legitimate usage of the passwords by users via commandline (should be discouraged)	windows sigma
legitimate usage of the script by a developer	t1216 t1216.001 windows sigma
legitimate usage of the script. always investigate what's being registered to confirm if it's benign	t1218 windows sigma
legitimate usage of the tool	t1219 windows sigma
legitimate usage of the uncommon windows work folders feature.	t1218 windows sigma
legitimate usage of the unsafe option	t1059 t1059.004 linux sigma
legitimate usage of the utility by administrators to query the event log	t1552 windows sigma
legitimate usage of the utility in order to debug and trace a program.	t1218 windows sigma
legitimate usage of this key would also trigger this. investigate the driver being added and make sure its intended	windows sigma
legitimate usage of wget utility to post a file	t1048 t1048.003 linux sigma
legitimate usage of xclip tools.	t1115 linux sigma
legitimate usage to restore snapshots	t1003 t1003.003 windows sigma
legitimate usb activity will also be detected. please verify and investigate as appropriate.	endpoint splunk
legitimate use	t1005 t1040 t1059 t1072 t1090 t1124 t1127 t1219 t1484 t1484.001 t1546 t1546.015 t1555 t1555.003 t1562 t1562.001 windows sigma
legitimate use by a software developer	t1127 windows sigma
legitimate use by a via a batch script or by an administrator.	t1059 windows sigma
legitimate use by administrative staff	t1133 windows sigma
legitimate use by administrators	t1569 t1569.002 windows sigma
legitimate use by an administrator	t1059 windows sigma
legitimate use by developers as part of nodejs development with visual studio tools	t1218 windows sigma
legitimate use by third party tools in order to investigate installed drivers	windows sigma
legitimate use by users	t1083 windows sigma
legitimate use by vm administrator	t1059 windows sigma
legitimate use case may require for users to disable mfa. filter as needed.	t1556 t1556.006 t1586 t1586.003 azure active directory gcp splunk
legitimate use case may require for users to disable mfa. filter lightly and monitor for any unusual activity.	t1556 t1556.006 okta tenant splunk
legitimate use for tracing purposes	t1127 windows sigma
legitimate use of 7z to compress wer \".dmp\" files for troubleshooting	t1560 t1560.001 windows sigma
legitimate use of 7z with a command line in which \".dmp\" or \".dump\" appears accidentally	t1560 t1560.001 windows sigma
legitimate use of acls to enable customer and staff access from the public internet into a public vpc	t1190 aws sigma
legitimate use of anydesk from a non-standard folder	t1219 windows sigma
legitimate use of archiving tools by legitimate user.	t1560 t1560.001 linux sigma
legitimate use of aws systems manager to establish a session to an ec2 instance.	t1021 aws elastic
legitimate use of azure hybrid connection manager and the azure service bus service	t1554 windows sigma
legitimate use of btunnels will also trigger this.	t1567 t1567.001 windows sigma
legitimate use of cloudflare tunnels will also trigger this.	t1071 t1071.001 t1567 t1567.001 windows sigma
legitimate use of cmstp.exe utility by legitimate user	t1218 t1218.003 t1548 t1548.002 windows sigma
legitimate use of crontab	t1007 linux sigma
legitimate use of crypto miners	t1496 windows linux sigma
legitimate use of custom plugins by users in order to enhance notepad++ functionalities	windows sigma
legitimate use of debugging tools	t1106 t1127 t1218 windows sigma
legitimate use of devtoolslauncher.exe by legitimate user	t1218 windows sigma
legitimate use of devtunnels will also trigger this.	t1071 t1071.001 t1567 t1567.001 windows sigma
legitimate use of dnx.exe by legitimate user	t1027 t1027.004 t1218 windows sigma
legitimate use of dsacls to bind to an ldap session	t1218 windows sigma
legitimate use of external db to save the results	t1112 windows sigma
legitimate use of fodhelper.exe utility by legitimate user	t1548 t1548.002 windows sigma
legitimate use of hybrid connection manager via azure function apps.	t1554 windows sigma
legitimate use of ipfs being used in the organisation. however the cs-uri regex looking for a user email will likely negate this.	t1056 sigma
legitimate use of msra.exe	t1055 windows sigma
legitimate use of net.exe utility by legitimate user	t1018 windows sigma
legitimate use of ngrok	t1090 t1102 t1567 t1568 t1568.002 t1572 linux sigma
legitimate use of nim on a developer systems	t1105 windows sigma
legitimate use of one of these tools	t1003 t1588 t1588.002 windows sigma
legitimate use of outlook forms	t1137 t1137.003 windows sigma
legitimate use of pester for writing tests for powershell scripts and modules	t1059 t1059.001 t1216 windows sigma
legitimate use of portmap.io domains	t1041 t1090 t1090.002 windows sigma
legitimate use of procdump by a developer or administrator	t1003 t1003.001 t1036 windows sigma
legitimate use of process hacker or system informer by developers or system administrators	t1543 windows sigma
legitimate use of psloglist by an administrator	t1087 t1087.001 t1087.002 windows sigma
legitimate use of psservice by an administrator	t1543 t1543.003 windows sigma
legitimate use of quick assist in the environment.	t1071 t1071.001 t1210 t1219 windows sigma
legitimate use of remote powershell execution	t1059 t1059.001 windows sigma
legitimate use of screen saver	t1218 t1218.011 windows sigma
legitimate use of screenconnect	t1059 t1059.003 windows sigma
legitimate use of screenconnect. disable this rule if screenconnect is heavily used.	t1059 t1059.003 windows sigma
legitimate use of screenshot utility	t1113 linux sigma
legitimate use of scx runasprovider executescript.	t1068 t1190 t1203 linux sigma
legitimate use of scx runasprovider invoke_executeshellcommand.	t1068 t1190 t1203 linux sigma
legitimate use of sysinternals tools	t1588 t1588.002 windows sigma
legitimate use of sysinternals tools. filter the legitimate paths used in your environment	t1588 t1588.002 windows sigma
legitimate use of telegram bots in the company	t1071 t1071.001 t1102 t1102.002 sigma
legitimate use of the `describeinstances` api call by an aws resource that requires information about instances in multiple regions.	t1580 aws elastic
legitimate use of the `sendcommand` api call to execute commands on ec2 instances using the ssm service may be done by system administrators or devops engineers for legitimate purposes.	T1651 cross-platform elastic
legitimate use of the api with a tool that the author wasn't aware of	t1105 windows sigma
legitimate use of the dll.	t1546 t1546.015 windows sigma
legitimate use of the external websites for troubleshooting or network monitoring	t1016 windows sigma
legitimate use of the feature (alerts should be investigated either way)	t1112 windows sigma
legitimate use of the feature by administrators (rare)	windows sigma
legitimate use of the impacket tools	t1557 t1557.001 windows sigma
legitimate use of the jamf cli tool by it support and administrators	macos sigma
legitimate use of the key to setup a debugger. which is often the case on developers machines	t1574 windows sigma
legitimate use of the library	t1105 t1620 windows sigma
legitimate use of the library for administrative activity	windows sigma
legitimate use of the localtonet service.	t1090 t1102 t1572 windows linux sigma
legitimate use of the multi session functionality	t1112 windows sigma
legitimate use of the ngrok service.	t1090 t1102 t1567 t1567.001 t1568 t1568.002 t1572 windows sigma
legitimate use of the pdqdeploy tool to execute these commands	windows sigma
legitimate use of the profile by developers or administrators	t1546 t1546.013 windows sigma
legitimate use of the system utilities to discover system time for legitimate reason	t1124 windows sigma
legitimate use of the tool	t1219 t1543 t1543.003 windows sigma
legitimate use of the tool by administrators or users to update metadata of a binary	t1027 t1027.005 t1036 t1036.003 windows sigma
legitimate use of the ui accessibility checker	windows sigma
legitimate use of the utilities by legitimate user for legitimate reason	t1482 windows sigma
legitimate use of vboxdrvinst.exe utility by virtualbox guest additions installation process	t1112 windows sigma
legitimate use of visual studio code tunnel	t1071 t1071.001 windows sigma
legitimate use of visual studio code tunnel and running code from there	t1071 t1071.001 windows sigma
legitimate use of visual studio code tunnel will also trigger this.	t1071 t1071.001 t1567 t1567.001 windows sigma
legitimate use of volume shadow copy mounts (backups maybe).	t1003 t1003.002 windows sigma
legitimate use of vssvc. maybe backup operations. it would usually be done by c:\windows\system32\vssvc.exe.	t1003 t1003.002 windows sigma
legitimate use of winrar command line version	t1560 t1560.001 windows sigma
legitimate use of winrar in a folder of a software that bundles winrar	t1560 t1560.001 windows sigma
legitimate use of winrar to compress wer \".dmp\" files for troubleshooting	t1560 t1560.001 windows sigma
legitimate use of winrar with a command line in which \".dmp\" or \".dump\" appears accidentally	t1560 t1560.001 windows sigma
legitimate use remote powershell sessions	t1021 t1021.006 t1059 t1059.001 windows sigma
legitimate use to compile jscript by developers.	t1127 windows sigma
legitimate use to pass password to different powershell commands	t1027 t1059 t1059.001 windows sigma
legitimate use via a batch script or by an administrator.	t1059 windows sigma
legitimate use via intune management. you exclude script paths and names to reduce fp rate	t1218 windows sigma
legitimate use when app-v is deployed	t1218 windows sigma
legitimate use/activation of windows recall	t1113 windows sigma
legitimate used of encrypted zip files	t1027 t1036 t1105 t1566 t1566.001 windows sigma
legitimate user account administration	t1098 aws sigma
legitimate user activity taking screenshots	t1113 macos sigma
legitimate user activity.	t1021 t1021.004 t1082 t1098 t1213 t1213.003 t1562 t1562.001 t1591 t1591.004 bitbucket sigma
legitimate user creation.	t1136 t1136.001 windows sigma
legitimate user shell modification activity.	t1546 linux elastic
legitimate user that was assigned on purpose to a bypass group	cisco sigma
legitimate user wrong password attempts.	t1021 t1021.004 t1078 t1078.004 t1110 bitbucket sigma
legitimate users and processes, such as system administration tools, may utilize shell utilities inside a container resulting in false positives.	t1059 cloud_defend elastic
legitimate users may create ssm command documents for legitimate purposes. ensure that the document is authorized and the user is known before taking action.	aws elastic
legitimate users may have to use ssm to perform actions against machines in the cloud to update or maintain them	t1566 t1566.002 aws sigma
legitimate users may miss to reply the mfa challenge within the time window or deny it by mistake.	t1078 t1078.004 t1586 t1586.003 t1621 google cloud platform tenant aws account splunk
legitimate users may subscribe to sns topics for legitimate purposes. ensure that the subscription is authorized and the subscription email address is known before taking action.	t1567 aws elastic
legitimate uses in which users or programs use the ssh service of serv-u for remote command execution	t1555 windows sigma
legitimate uses of logon scripts distributed via group policy	t1218 windows sigma
legitimate uses of mouse lock software	t1056 t1056.002 windows sigma
legitimate uses of teamviewer in an organisation	t1219 windows sigma
legitimate vbscript	t1112 windows sigma
legitimate webdav administration	t1071 t1071.001 sigma
legitimate webproxy settings modification	t1539 macos elastic
legitimate windivert driver usage	t1557 t1557.001 t1599 t1599.001 windows sigma
legitimate windows application that are not on the list loading this dll. filter as needed.	t1218 t1218.003 endpoint splunk
legitimate windows defender configuration changes	t1112 t1562 windows elastic
legitimate winrm usage	t1190 windows sigma
legitimate wmi query	t1112 windows sigma
legitimate, non-default assistive technology applications execution	t1218 windows sigma
legitime usage	t1490 windows sigma
legitime usage of sdelete	t1070 t1070.004 windows sigma
legtimate administrator actions of adding members from a role	t1078 t1078.004 azure sigma
legtimate administrator actions of removing members from a role	t1098 azure sigma
likelihood is related to how often the paths are used in the environment	t1219 windows sigma
likely	t1006 t1059 t1059.001 t1082 t1091 t1200 t1217 t1482 t1560 t1560.001 windows linux sigma
likely from legitimate applications reading their key. requires heavy tuning	t1574 t1574.011 windows sigma
likely with legitimate usage of \".rdp\" files	t1219 windows sigma
likely with other browser software. apply additional filters for any other browsers you might use.	t1219 windows sigma
likely. many admin scripts and tools leverage powershell in their bat or vb scripts which may trigger this rule often. it is best to add additional filters or use this to hunt for anomalies	t1059 t1059.001 windows sigma
limited false positive. it may trigger by some windows update that will modify this registry.	t1548 t1548.002 endpoint splunk
limited false positives as the scope is limited to sam, system and security hives.	t1003 t1003.002 endpoint splunk
limited false positives as this requires an active administrator or adversary to bring in, import, and execute.	t1482 endpoint splunk
limited false positives have been identified. there are limited instances where `rundll32.exe` may be spawned by a legitimate print driver.	t1547 T1547.012 endpoint splunk
limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.	t1105 endpoint splunk
limited false positives may be present in small environments. tuning may be required based on parent process.	t1055 endpoint splunk
limited false positives may be present. filter as needed based on initial analysis.	t1059 t1059.001 endpoint splunk
limited false positives related to third party software registering .dll's.	t1218 t1218.010 endpoint splunk
limited false positives should be present as installutil is not typically used to download remote files. filter as needed based on developers requirements.	t1218 T1218.004 endpoint splunk
limited false positives should be present as this is not commonly used by legitimate applications.	t1548 t1548.002 endpoint splunk
limited false positives should be present.	t1566 t1566.001 endpoint splunk
limited false positives should be present. filter as needed by parent process or application.	t1218 T1218.004 endpoint splunk
limited false positives should be present. it is possible some third party applications may use older versions of psexec, filter as needed.	t1569 t1569.002 endpoint splunk
limited false positives will be present as control.exe does not natively load from writable paths as defined. one may add .cpl or .inf to the command-line if there is any false positives. tune as needed.	t1218 t1218.002 endpoint splunk
limited false positives will be present, however, tune as necessary. some applications may legitimately load mshtml.dll.	t1566 t1566.001 endpoint splunk
limited false positives will be present. some applications do load drivers	t1543 t1543.003 endpoint splunk
limited false positives will be present. typically, applications will use `bitsadmin.exe`. any filtering should be done based on command-line arguments (legitimate applications) or parent process.	t1197 endpoint splunk
limited false positives with the query restricted to specified paths. add more world writeable paths as tuning continues.	t1218 t1218.010 endpoint splunk
limited false positives, however it may be required to filter based on parent process name or network connection.	t1105 t1197 endpoint splunk
limited false positives, however this analytic will need to be modified for each environment if sysmon is not used.	t1560 t1560.001 endpoint splunk
limited false positives, however, tune as needed.	t1133 t1190 endpoint splunk
limited false positives. filter as needed.	t1055 t1059 t1059.001 t1547 T1547.012 endpoint splunk
limited false positives. however, tune based on scripts that may perform this action.	t1562 t1562.001 endpoint splunk
limited false positives. if there is a true false positive, filter based on command-line or parent process.	t1482 endpoint splunk
limited false positives. it is possible administrators will utilize start-bitstransfer for administrative tasks, otherwise filter based parent process or command-line arguments.	t1197 endpoint splunk
limited false positives. may filter as needed.	t1059 t1059.001 endpoint splunk
limited to no false positives are expected.	t1112 t1548 t1548.002 endpoint splunk
limited to no known false positives.	t1059 t1059.003 endpoint splunk
limitted. this anomaly behavior is not commonly seen in clean host.	t1218 t1218.005 endpoint splunk
limitted. this parameter is not commonly used by windows application but can be used by the network operator.	t1218 t1218.011 endpoint splunk
linux hostnames composed of 16 characters.	t1021 t1021.002 windows sigma
linux package installer/uninstaller may cause this event. please update you filter macro to remove false positives.	t1070 t1070.004 t1485 endpoint splunk
loading a user environment from a backup or a domain controller	t1137 windows sigma
loading of legitimate driver	t1574 windows sigma
local accounts managed by privileged account management tools	t1136 t1136.001 windows sigma
local domain admin account used for azure ad connect	t1003 t1003.006 windows sigma
log rotation.	t1070 t1070.002 linux sigma
logging bucket deletions may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. logging bucket deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 gcp elastic
logging sink deletions may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. logging sink deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 gcp elastic
logging sink modifications may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. sink modifications from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1537 gcp elastic
logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.	t1556 o365 tenant splunk
mailbox folder permissions may be configured for legitimate purposes, filter as needed.	t1098 T1098.002 o365 tenant splunk
maintenance activity	t1070 t1070.001 t1562 t1562.002 windows sigma
many benign applications will create processes from executables in windows\temp, although unlikely to exceed the given threshold. filter as needed.	t1059 endpoint splunk
many legitimate applications can register a new custom protocol handler. additional filters needs to applied according to your environment.	t1112 windows sigma
many legitimate applications leverage this dll. (visual studio, jetbrains, ruby, anaconda, githubdesktop, etc.)	t1574 t1574.001 t1574.002 windows sigma
many legitimate applications or scripts could leverage \"bitsadmin\". this event is best correlated with eid 16403 via the jobid field	t1197 windows sigma
many service accounts configured with your aws infrastructure are known to exhibit this behavior. please adjust the threshold values and filter out service accounts from the output. always verify whether this search alerted on a human user.	t1078.004 aws instance splunk
many service accounts configured within a cloud infrastructure are known to exhibit this behavior. please adjust the threshold values and filter out service accounts from the output. always verify if this search alerted on a human user.	t1078 t1078.004 cloud instance splunk
many service accounts configured within an aws infrastructure are known to exhibit this behavior. please adjust the threshold values and filter out service accounts from the output. always verify if this search alerted on a human user.	t1078 t1078.004 aws instance cloud instance splunk
many service accounts configured within an aws infrastructure do not have multi factor authentication enabled. please ignore the service accounts, if triggered and instead add them to the aws_service_accounts.csv file to fine tune the detection. it is also possible that the search detects users in your environment using single sign-on systems, since the mfa is not handled by aws.	aws instance splunk
master password change is a legitimate means to regain access to a db instance in the case of a lost password. ensure that the instance should not be modified in this way before taking action.	t1098 aws elastic
maybe some system utilities in rare cases use linking keys for backward compatibility	t1546 t1546.015 windows sigma
mfa may be disabled and performed by a system administrator.	gcp sigma
mfa policies may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1531 google_workspace elastic
mfa settings may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1556 google_workspace elastic
microsoft antimalware service executable installed on non default installation path.	t1574 windows elastic
microsoft may provide updates to these binaries. verify that these changes do not correspond with your normal software update cycle.	t1546 t1546.008 endpoint splunk
microsoft operations manager (mom)	t1059 t1059.001 windows sigma
microsoft sccm	t1059 t1059.001 t1059.005 t1218 windows sigma
microsoft windows installers leveraging rundll32 for installation.	t1059 t1218 t1552 windows elastic
microsofts algorithm to identify risky applications is unknown and may flag legitimate applications.	t1528 o365 tenant splunk
might trigger if a legitimate new sip provider is registered. but this is not a common occurrence in an environment and should be investigated either way	windows sigma
migration of an account into a new domain	t1134 t1134.005 windows sigma
migration of privileged accounts.	t1134 t1134.005 endpoint splunk
mimikatz can be useful for testing the security of networks	t1003 windows sigma
minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable windows defender to improve performance, but this generally is not considered a good security practice.	t1562 t1562.001 windows sigma
minimal. but network operator can use this application to load dll.	t1218 t1218.010 endpoint splunk
misconfigured role permissions	t1548 t1556 azure sigma
misconfigured systems	t1078 t1078.004 t1110 azure sigma
missing .vm files	t1190 velocity sigma
mistyped commands or legitimate binaries named to match the pattern	t1036 t1036.006 macos sigma
mknod is a linux system program. some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. usage by web servers is more likely to be suspicious.	_deprecated elastic
moderate-to-low; despite the shorter length/lower entropy for some of these, because of high specificity, fp appears to be fairly limited in many environments.	t1059 t1059.001 windows sigma
modifications in the msds-keycredentiallink attribute can be done legitimately by the azure ad connect synchronization account or the adfs service account. these accounts can be added as exceptions.	t1556 windows elastic
modifying a kubernetes job or cronjob may need to be done by a system administrator.	kubernetes sigma
modifying a kubernetes rolebinding may need to be done by a system administrator.	kubernetes sigma
modifying the kubernetes admission controller may need to be done by a system administrator.	t1078 t1552 t1552.007 kubernetes sigma
monitoring activity	t1003 t1027 t1033 t1134 windows sigma
monitoring tools	t1047 windows sigma
msiexec.exe hiding desktop.ini	t1564 t1564.001 windows sigma
msmpeng might crash if the \"c:\\" partition is full	t1211 t1562 t1562.001 windows sigma
msp detection searcher	t1059 t1059.001 windows sigma
msxsl is not installed by default and is deprecated, so unlikely on most systems.	t1220 windows sigma
multiple account lockouts may be also triggered by an application malfunction. filter as needed, and monitor for any unusual activity.	t1110 okta tenant splunk
multiple denifed mfa requests in a short period of span may also be a sign of authentication errors. investigate and filter as needed.	t1621 azure active directory splunk
multiple failed mfa requests may also be a sign of authentication or application issues. filter as needed and monitor for any unusual activity.	t1621 okta tenant splunk
nated servers that process email traffic may false and should be excluded from this rule as this is expected behavior for them. consumer and personal devices may send email traffic to remote internet destinations. in this case, such devices or networks can be excluded from this rule if this is expected behavior.	t1048 _deprecated elastic
natively, `dllhost.exe` will access the files. every environment will have additional native processes that do as well. filter by process_name. as an aside, one can remove process_name entirely and add `object_name=shadowcopy`.	t1003 t1003.002 endpoint splunk
naughty administrators	t1003 t1003.001 t1003.002 t1003.004 t1003.006 windows sigma
need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts	t1218 windows sigma
need tuning applocker or add exceptions in siem	t1059 t1059.001 t1059.003 t1059.005 t1059.006 t1059.007 t1204 t1204.002 windows sigma
netcat and openssl are common tools used for establishing network connections and creating encryption keys. while they are popular, capturing the stdout and stderr in a named pipe pointed to a shell is anomalous.	t1059 _deprecated elastic
netcat is a dual-use tool that can be used for benign or malicious activity. netcat is included in some linux distributions so its presence is not necessarily suspicious. some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks.	t1059 linux elastic
netowrk administrator or it may execute this command for auditing processes and services.	t1047 endpoint splunk
network acl's may be created by a network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. network acl creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1133 aws elastic
network acl's may be deleted by a network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. network acl deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.	t1048 t1048.003 t1566 t1566.001 gsuite splunk
network admin can delete services unit configuration file as part of normal software installation. filter is needed.	t1070 t1070.004 endpoint splunk
network admin can resize the shadowstorage for valid purposes.	t1490 endpoint splunk
network admin can terminate a process using this linux command. filter is needed.	t1562 t1562.001 endpoint splunk
network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.	t1021 t1021.001 t1112 endpoint splunk
network admin may modify this firewall feature that may cause this rule to be triggered.	t1562 t1562.007 endpoint splunk
network admin or normal user may share files to customer and external team.	t1567 t1567.002 gsuite splunk
network administrator can execute this command to enumerate dns record. filter or add other paths to the exclusion as needed.	t1590.002 endpoint splunk
network administrator can use this application to kill process during audit or investigation.	t1562 t1562.001 endpoint splunk
network administrator can use this command tool to audit rdp access of user in specific network or host.	t1033 endpoint splunk
network administrator can use this command tool to backup registry before updates or modifying critical registries.	t1012 endpoint splunk
network administrator can use this tool for auditing process.	t1049 t1555 endpoint splunk
network administrator may disable this services as part of its audit process within the network. filter is needed.	t1489 endpoint splunk
network administrator may used this command for checking purposes	t1059.001 t1592 endpoint splunk
network administrators	t1562 t1562.004 linux sigma
network monitoring or management products may have a web server component that runs shell commands as part of normal behavior.	t1190 t1505 _deprecated linux elastic
network operator may disable audit event logs for debugging purposes.	t1070 t1070.001 endpoint splunk
network operator may disable this feature of windows but not so common.	t1562 t1562.001 endpoint splunk
network operator may enable or disable this windows feature.	t1027 t1027.005 endpoint splunk
network operator may use this batch command to delete recursively a directory or files within directory	t1070 t1070.004 endpoint splunk
network operrator may use this command.	t1059.001 t1546 t1546.015 endpoint splunk
network policy being modified and deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
network policy being modified and deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
network security configuration being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
network security configuration modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
network service user name of a not-covered localization	t1021 t1021.006 t1059 t1059.001 windows sigma
network watcher deletions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. network watcher deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 azure elastic
new domain controller computer account, check user sids within the value attribute of event 5136 and verify if it's a regular user or dc computer account.	t1098 windows sigma
new domain controllers or certian scripts run by administrators.	t1003 t1003.006 t1207 endpoint splunk
new members can be added to the dnsadmins group as part of legitimate administrative tasks. filter as needed.	t1098 endpoint splunk
new model deployments.	aws_bedrock elastic
new or unusual command and user geolocation activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; expansion into new regions; increased adoption of work from home policies; or users who travel frequently.	aws elastic
new or unusual user command activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; or changes in the way services are used.	aws elastic
new subnets added requiring routing setup	t1190 aws sigma
new vpc creation requiring setup of a new route table	t1190 aws sigma
new vpcs and subnets being setup requiring a different security profile to those already defined	t1190 aws sigma
newly onboarded users who are registering an mfa method for the first time will also trigger this detection.	t1556 t1556.006 azure active directory aws account splunk
newly setup system.	t1204 t1204.002 windows sigma
ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0)	t1572 windows sigma
ninite contacting githubusercontent.com	t1102 t1102.001 windows sigma
no false positives have been identified.	t1486 endpoint splunk
no false positives here, only bootloaders. filter as needed or create a lookup as a baseline.	t1542 t1542.001 endpoint splunk
no false positives known. filter as needed.	t1566 t1566.001 endpoint splunk
no known false positives	t1053.005 endpoint splunk
no known false positives for this detection.	web server splunk
no known false positives for this detection. please review this alert	t1110 T1110.003 T1110.004 t1586 t1586.003 google cloud platform tenant splunk
no known false postives for this detection. please review this alert	t1110 T1110.003 T1110.004 t1586 t1586.003 aws account splunk
noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. in this case, a filter is needed.	t1059 t1059.005 t1102 endpoint splunk
none at the moment	t1564.001 endpoint splunk
none at this time	t1090 t1090.003 endpoint splunk
none currently known	t1200 t1498 t1557 T1557.002 infrastructure splunk
none identified	t1048 t1048.003 t1070 t1204.002 t1546 t1546.011 t1566 t1566.001 endpoint splunk
none identified, setting up the \"customsd\" value is considered a legacy option and shouldn't be a common activity.	t1562.002 endpoint splunk
none identified. attempts to add deny aces to services, especially security-related services should be immediately investigated.	t1564 endpoint splunk
none identified. attempts to disable security-related services should be identified and understood.	t1222.001 t1562 t1562.001 t1564 endpoint splunk
none identified. attempts to modify or tamper with the security descriptor settings of the scmanager service should be immediately investigated and understood.	t1569.002 endpoint splunk
none thus far found	t1210 windows splunk
none.	t1078 t1078.004 t1207 t1222 t1222.001 t1484 endpoint aws instance splunk
none. account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor.	t1078 t1078.001 infrastructure splunk
normal application like mmc.exe and other ldap query tool may trigger this detections.	t1087 t1087.002 endpoint splunk
normal archive transfer via http protocol may trip this detection.	t1048 t1048.003 endpoint splunk
normal browser application may use this technique. please update the filter macros to remove false positives.	t1055 endpoint splunk
normal download of file in telegram app. (if it was a common app in network)	t1105 endpoint splunk
normal email contains this link that are known application within the organization or network can be catched by this detection.	t1566 t1566.001 gsuite splunk
normal enterprise spn requests activity	t1558 t1558.003 zeek sigma
normal use of hping is uncommon apart from security testing and research. use by non-security engineers is very uncommon.	t1082 linux elastic
normal use of iodine is uncommon apart from security testing and research. use by non-security engineers is very uncommon.	t1572 _deprecated elastic
normal user or normal transaction may contain the subject and file type attachment that this detection try to search	t1566 t1566.001 gsuite splunk
not all permanent key creations are malicious. if there is a policy of rotating keys this search can be adjusted to provide better context.	t1078 aws account splunk
not all rbac authorications are malicious. rbac authorizations can uncover malicious activity specially if sensitive roles have been granted.	gcp gke kubernetes cluster aws eks kubernetes cluster azure aks kubernetes cluster splunk
not all service accounts interactions are malicious. analyst must consider ip and verb context when trying to detect maliciousness.	azure aks kubernetes cluster splunk
not all unauthenticated requests are malicious, but frequency, ua and source ips and direct request to api provide context.	t1526 amazon eks kubernetes cluster pod splunk
not all unauthenticated requests are malicious, but frequency, user agent and source ips will provide context.	t1526 gcp kubernetes cluster splunk
not all unauthenticated requests are malicious, but frequency, user agent, source ips and pods will provide context.	t1526 gcp kubernetes cluster splunk
not all unauthenticated requests are malicious, but source ips, useragent, verb, request uri and response status will provide context.	t1526 azure aks kubernetes cluster splunk
not commonly run by administrators, especially if remote logging is configured	t1552 t1552.003 cisco sigma
not commonly run by administrators. also whitelist your known good certificates	t1552 t1552.004 t1553 t1553.004 cisco sigma
not known at this moment.	t1059 endpoint splunk
not so common. but 3rd part app may load this dll.	t1218 t1218.003 endpoint splunk
note that false positives may occur due to the use of the enable-psremoting cmdlet by legitimate users, such as system administrators. it is recommended to apply appropriate filters as needed to minimize the number of false positives.	t1059 t1059.001 endpoint splunk
note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities.	t1543 t1543.003 endpoint splunk
note that since the event contain the change for both values. this means that this will trigger on both enable and disable	windows sigma
ntds maintenance	t1003 t1003.003 windows sigma
o365 security and compliance may also generate false positives or trigger on legitimate behavior, filter as needed.	t1078 t1078.004 o365 tenant splunk
oauth applications may access mailboxes for legitimate purposes, you can use the src_ip to add trusted sources to an allow list.	T1114.002 o365 tenant splunk
oauth applications that require file permissions may be legitimate, investigate and filter as needed.	t1528 o365 tenant splunk
oauth applications that require mail permissions may be legitimate, investigate and filter as needed.	t1528 o365 tenant splunk
occasional fps might occur if onenote is used internally to share different embedded documents	windows sigma
office documents commonly have templates that refer to external addresses, like \"sharepoint.ourcompany.com\" may have to be tuned.	t1203 windows sigma
office macro for automation may do this behavior	t1566 t1566.001 endpoint splunk
okta policies being modified or deleted may be performed by a system administrator.	okta sigma
okta policies modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	okta sigma
old browsers	t1071 t1071.001 sigma
older systems that support kerberos rc4 by default like netapp may generate false positives. filter as needed	t1558 t1558.003 endpoint splunk
on modern windows system, the \"setup16\" utility is practically never used, hence false positive should be very rare.	t1574 t1574.005 windows sigma
one might need to exclude other internet browsers found in it's network or other applications like ones mentioned above from microsoft defender.	t1102 t1102.001 windows sigma
operations performed through windows sccm or equivalent	t1547 t1547.009 windows sigma
operators can execute third party tools using these parameters.	t1204 endpoint splunk
organization approved new members	t1136 t1136.003 github sigma
other antivirus software installations could cause windows to disable that eventlog (unknown)	t1562 t1562.001 windows sigma
other browser not listed related to chrome may catch by this rule.	t1555 t1555.003 endpoint splunk
other browser not listed related to firefox may catch by this rule.	t1555 t1555.003 endpoint splunk
other child processes will depend on the dll being registered by actions like \"regsvr\". in case where the dlls have external calls (which should be rare). other child processes might spawn and additional filters need to be applied.	t1218 t1218.008 windows sigma
other cmdlets that may use the same parameters	t1562 t1562.001 windows sigma
other command line tools, that use these flags	t1560 t1560.001 windows sigma
other currently unknown false positives	windows sigma
other dlls with the same imphash	t1562 t1562.002 windows sigma
other legimate tools loading drivers. including but not limited to, sysinternals, cpu-z, avs etc. a baseline needs to be created according to the used products and allowed tools. a good thing to do is to try and exclude users who are allowed to load drivers.	t1562 t1562.001 windows sigma
other legimate tools using this driver and filename (like sysinternals). note - clever attackers may easily bypass this detection by just renaming the driver filename. therefore just medium-level and don't rely on it.	t1562 t1562.001 windows sigma
other legimate tools using this service names and drivers. note - clever attackers may easily bypass this detection by just renaming the services. therefore just medium-level and don't rely on it.	t1562 t1562.001 windows sigma
other legimate tools, which do adsi (ldap) operations, e.g. any remoting activity by mmc, powershell, windows etc.	t1001 t1001.003 windows sigma
other legitimate \"windows terminal\" profiles	windows sigma
other legitimate binaries named \"thor.exe\" that aren't published by nextron systems	t1574 t1574.002 windows sigma
other legitimate browsers not currently included in the filter (please add them)	windows sigma
other legitimate extensions currently not in the list either from third party or specific windows components.	t1574 windows sigma
other legitimate network providers used and not filtred in this rule	t1003 windows sigma
other legitimate processes loading those dlls in your environment.	t1056 t1056.002 windows sigma
other legitimate windows processes not currently listed	t1486 t1562 t1562.001 windows sigma
other parent binaries using gup not currently identified	windows sigma
other parent processes other than notepad++ using gup that are not currently identified	t1105 windows sigma
other ports can be used, apply additional filters accordingly	windows sigma
other possible 3rd party msi software installers use this technique as part of its installation process.	t1218 t1218.007 endpoint splunk
other programs that cause these patterns (please report)	t1021 windows sigma
other programs that use these command line option and accepts an 'all' parameter	t1059 t1059.001 t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 windows sigma
other scripts	t1059 t1059.001 windows sigma
other smtp tools	t1048 t1048.003 windows sigma
other third part application may used this parameter but not so common in base windows environment.	t1218 t1218.010 endpoint splunk
other third party applications not listed.	t1070 t1070.004 windows sigma
other third party chromium browsers located in appdata	t1574 t1574.001 t1574.002 windows sigma
other tools can access lsass for legitimate reasons and generate an event. in these cases, tweaking the search may help eliminate noise.	t1003 t1003.001 windows splunk
other tools can import the same dlls. these tools should be part of a whitelist. false positives may be present with any process that authenticates or uses credentials, powershell included. filter based on parent process.	t1003 t1003.001 windows splunk
other tools could load images into lsass for legitimate reason. but enterprise tools should always use signed dlls.	t1003.001 windows splunk
other tools or script may used this to change code page to utf-* or others	t1059 endpoint splunk
other tools that incidentally use the same command line parameters	t1059 t1059.001 windows sigma
other tools that use a --cpu-priority flag	t1068 linux sigma
other tools that work with encoded scripts in the command line instead of script files	t1059 t1059.001 windows sigma
other unknown legitimate or custom paths need to be filtered to avoid false positives	t1112 windows sigma
other vb scripts that leverage the same starting command line flags	t1218 windows sigma
owner being removed may be performed by a system administrator.	azure sigma
owner removed from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
packages or applications being legitimately used by users or administrators	windows sigma
particular web applications may spawn a shell process legitimately	t1190 t1505 t1505.003 windows sigma
password policies may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1098 google_workspace elastic
payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects	t1078 gcp account splunk
pim (privileged identity management) generates this event each time 'eligible role' is enabled.	t1078 t1098 t1098.003 azure sigma
planned windows defender configuration changes.	t1059 t1562 windows elastic
pnputil.exe being executed from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1547 windows sigma
pnputil.exe being used may be performed by a system administrator.	t1547 windows sigma
pods deletions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
pods may be deleted by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. pods deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure elastic
point-to-site vpn being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
point-to-site vpn modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
possible admin activity	t1562 t1562.001 windows sigma
possible administrative activity	t1562 t1562.001 windows sigma
possible but rare	t1202 windows sigma
possible depending on environment. pair with other factors such as net connections, command-line args, etc.	t1127 windows sigma
possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.	t1589 T1589.002 endpoint splunk
possible fp during log rotation	t1070 windows sigma
possible fps during first installation of notepad++	windows sigma
possible new printer installation may add driver component on this registry.	t1547 T1547.012 endpoint splunk
possible undocumented parents of \"msdt\" other than \"pcwrun\"	t1218 windows sigma
possible, different agents with a 8 character binary and a 4, 8 or 16 character service name	t1021 t1021.002 t1569 t1569.002 t1570 windows sigma
potential for some third party applications to disable amsi upon invocation. filter as needed.	t1059 t1059.001 t1562 endpoint splunk
potential fp by sysadmin opening a zip file containing a legitimate iso file	t1566 t1566.001 windows sigma
potential to be triggered by an administrator disabling protections for troubleshooting purposes.	t1556 endpoint splunk
powershell and windows command shell are often observed as legit child processes of the jetbrains teamcity service and may require further tuning.	t1059 t1190 windows elastic
powershell developer may used this function in their script for instance checking too.	t1027 t1027.005 t1059.001 endpoint splunk
powershell may used this function to archive data.	t1560 endpoint splunk
powershell may used this function to process compressed data.	t1059 t1059.001 endpoint splunk
powershell may used this function to store out object into memory.	t1059 t1059.001 endpoint splunk
powershell remoting is a dual-use protocol that can be used for benign or malicious activity. it's important to baseline your environment to determine the amount of noise to expect from this tool.	t1021 t1059 windows elastic
powershell scripts fixing hivenightmare / serioussam acls	t1003 t1003.002 windows sigma
powershell scripts running as system user	t1059 t1059.001 windows sigma
powershell scripts that download content from the internet	t1059 t1059.001 windows sigma
powershell scripts that use this capability for troubleshooting.	t1003 t1059 windows elastic
printer software / driver installations	t1218 t1218.005 windows sigma
printing documents via notepad might cause communication with the printer via port 9100 or similar.	t1055 windows sigma
privilege roles may be assigned for legitimate purposes, filter as needed.	t1098 t1098.003 o365 tenant splunk
privileged graph api permissions may be assigned for legitimate purposes. filter as needed.	t1003.002 o365 tenant azure active directory splunk
privileged iam users with security responsibilities may be expected to make changes to the config service in order to align with local security policies and requirements. automation, orchestration, and security tools may also make changes to the config service, where they are used to automate setup or configuration of aws accounts. other kinds of user or service contexts do not commonly make changes to this service.	t1562 aws elastic
procdump illegally bundled with legitimate software.	t1036 t1036.003 windows sigma
process dumping is the expected behavior of the tool. so false positives are expected in legitimate usage. the pid/process name of the process being dumped needs to be investigated	t1218 windows sigma
processes related to software installation	t1486 t1562 t1562.001 windows sigma
processes such as ms office using ieproxy to render html content.	t1071 t1559 windows elastic
programs that connect locally to the rdp port	t1021 t1021.001 t1090 t1090.001 t1090.002 windows sigma
programs that use the same command line flag	t1588 t1588.002 windows sigma
programs that use the same command line flags	t1033 windows sigma
programs that use the same registry key	t1588 t1588.002 windows sigma
programs using powershell directly without invocation of a dedicated interpreter.	t1059 t1059.001 windows sigma
proxy ssl certificate with subject modification	windows sigma
psexec installed via windows store doesn't contain original filename field (false negative)	t1036 t1036.003 windows sigma
psexec is a dual-use tool that can be used for benign or malicious activity. it's important to baseline your environment to determine the amount of noise to expect from this tool.	t1021 t1569 t1570 windows elastic
pst export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.	t1114 o365 tenant splunk
public access is a common configuration used to enable access from outside a private vpc. ensure that the instance should not be modified in this way before taking action.	t1556 aws elastic
puppeteer invocation exceptions often contain child_process related errors, that doesn't necessarily mean that the app is vulnerable.	t1190 nodejs sigma
python libraries that use a flag starting with \"-c\". filter according to your environment	t1059 windows sigma
quite minimal false positive expected.	t1574 t1574.002 endpoint splunk
rapid authentication from the same user using more than 5 different user agents and 3 application ids is highly unlikely under normal circumstances. however, there are potential scenarios that could lead to false positives.	t1078 azure tenant o365 tenant splunk
rare and unusual errors may indicate an impending service failure state. rare and unusual user error activity can also be due to manual troubleshooting or reconfiguration attempts by insufficiently privileged users, bugs in cloud automation scripts or workflows, or changes to iam privileges.	aws elastic
rare case of troubleshooting by an administrator or support that has to be investigated regardless	t1003 t1003.001 windows sigma
rare cases of administrative activity	t1003 t1003.002 windows sigma
rare false positives could occur on servers with multiple drives.	windows sigma
rare false positives could occur since service termination could happen due to multiple reasons	windows sigma
rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting	t1562 t1562.002 windows sigma
rare fp could occur due to the non linearity of the scriptblocktext log	t1574 t1574.011 windows sigma
rare intended use of hidden services	t1574 t1574.011 windows sigma
rare legitimate access to anonfiles.com	t1567 t1567.002 windows sigma
rare legitimate add to registry via cli (to these locations)	t1112 t1562 t1562.001 windows sigma
rare legitimate administrative activity	windows sigma
rare legitimate crashing of the lsass process	t1003 t1003.001 windows sigma
rare legitimate dump of the process by the operating system due to a crash of lsass	t1003 t1003.001 windows sigma
rare legitimate files with similar filename structure	t1003 t1003.001 windows sigma
rare legitimate installation of kernel drivers via sc.exe	t1543 t1543.003 windows sigma
rare legitimate software.	windows sigma
rare legitimate usage of some of the extensions mentioned in the rule	t1547 t1547.001 windows sigma
rare legitimate use by administrators to test software (should always be investigated)	t1562 t1562.001 windows sigma
rare legitimate use of psexec from the locations mentioned above. this will require initial tuning based on your environment.	t1569 t1569.002 windows sigma
rare need to clear logs before doing something. sometimes used by installers or cleaner scripts. the script should be investigated to determine if it's legitimate	t1070 t1070.001 windows sigma
rare occasions of legitimate cases where kernel debugging is necessary in production. investigation is required	windows sigma
rare occasions where a malicious package uses the exact same name and version as a legtimate application	windows sigma
rare programs that contain the word dump in their name and access lsass	t1003 t1003.001 windows sigma
rare programs that use bitsadmin and update from regional tlds e.g. .uk or .ca	t1071 t1071.001 t1197 sigma
rare temporary workaround for library misconfiguration	t1574 t1574.006 linux sigma
rdp connections may be made directly to internet destinations in order to access windows cloud server instances but such connections are usually made only by engineers. in such cases, only rdp gateways, bastions or jump servers may be expected internet destinations and can be exempted from this rule. rdp may be required by some work-flows such as remote access and support for specialized software products and servers. such work-flows are usually known and not unexpected. usage that is unfamiliar to server or network owners can be unexpected and suspicious.	t1048 t1190 _deprecated elastic
rdp gateways may have unusually high amounts of traffic from all other hosts' rdp applications in the network.	t1021 t1021.001 endpoint splunk
read only access list authority	t1547 t1547.009 windows sigma
regular file creation during system update or software installation by the package manager	linux sigma
remote administration of registry values	t1112 rpc_firewall sigma
remote administrative tasks on windows events	rpc_firewall sigma
remote desktop may be used legitimately by users on the network.	t1021 t1021.001 endpoint splunk
renaming a computer account name to a name that not end with '$' is highly unsual and may not have any legitimate scenarios.	t1078 t1078.002 endpoint splunk
repurposing of an elb or alb to serve a different or additional application	t1190 aws sigma
resetting the dsrm password for legitamate reasons, i.e. forgot the password. disaster recovery. deploying ad backdoor deliberately.	t1098 endpoint splunk
restoring db instances may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. instance restoration by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1578 aws elastic
role chaining can be used as an access control. ensure that this behavior is not part of a legitimate operation before taking action.	t1548 t1550 aws elastic
role deletions may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. role deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1531 gcp elastic
rolebinding/clusterrolebinding being modified and deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
rolebinding/clusterrolebinding modification from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
rolebindings and clusterrolebinding being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	gcp sigma
rolebindings and clusterrolebinding modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	gcp sigma
rollout of log collection agents (the setup routine often includes a reset of the local eventlog)	t1070 t1070.001 windows sigma
route table could be modified or deleted by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. route table being modified from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule. also automated processes that use terraform may lead to false positives.	aws elastic
route tables may be created by a system or network administrators. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. route table creation by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule. automated processes that use terraform may lead to false positives.	aws elastic
rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-kamlyuk-kamluk-computrace-backdoor-revisited.pdf	t1055 windows sigma
rule collections (application, nat, and network) being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	t1562 t1562.004 azure sigma
rule collections (application, nat, and network) modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 t1562.004 azure sigma
runas command-line tool using /netonly parameter	t1550 t1550.002 windows sigma
rundll32.exe with zzzzinvokemanagedcustomactionoutofproc in command line and msiexec.exe as parent process - https://twitter.com/sbousseaden/status/1388064061087260675	t1218 windows sigma
russian speaking people changing the codepage	t1036 windows sigma
s3 buckets can be accessed from any ip, as long as it can make a successful connection. this will be a false postive, since the search is looking for a new ip within the past hour	T1530 s3 bucket splunk
sam is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. althoughno false positives have been identified.	t1489 endpoint splunk
saml provider being updated from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1078 t1548 t1550 t1550.001 aws sigma
saml provider could be updated by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. saml provider updates by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1484 aws elastic
scanning attempts with the abnormal use of the http post method with no indication of code execution within the http client (request) body. an example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. see description for investigation tips.	t1021 t1021.006 t1068 t1190 t1203 t1210 zeek sigma
scheduled tasks or scripts that require information about instances in multiple regions.	t1580 aws elastic
scripts and administrative tools that use inf files for driver installation with setupapi.dll	t1218 t1218.011 windows sigma
scripts and administrative tools used in the monitored environment	t1003 t1027 t1033 t1070 t1070.001 t1134 t1485 t1562 t1562.002 windows sigma
scripts created by developers and admins	t1071 t1071.001 t1105 t1222 t1222.001 t1567 windows linux sigma
scripts or links on the user desktop used to lock the workstation instead of windows+l or the menu option	windows sigma
scripts or tools that download attachments from these domains (onenote, outlook 365)	t1105 t1608 windows sigma
scripts or tools that download files	t1059 t1059.001 t1105 windows sigma
searching software such as \"everything.exe\"	t1003 windows sigma
secrets being modified or deleted may be performed by a system administrator.	t1552 t1552.001 kubernetes azure sigma
secrets modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1552 t1552.001 gcp azure sigma
security audits may trigger this alert. conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this alert.	t1110 ml elastic
security audits, maintenance, and network administrative scripts may trigger this alert when run under web processes.	t1047 t1059 t1190 t1505 windows elastic
security scans and tests may result in these errors. misconfigured or buggy applications may produce large numbers of these errors. if the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity.	apm elastic
security teams may leverage powerview proactively to identify and remediate sensitive file shares. filter as needed.	t1135 endpoint splunk
security testing may produce events like this. activity of this kind performed by non-engineers and ordinary users is unusual.	t1218 windows elastic
security testing tools and frameworks may run `nmap` in the course of security auditing. some normal use of this command may originate from security engineers and network or server administrators. use of nmap by ordinary users is uncommon.	_deprecated elastic
security testing tools and frameworks may run this command. some normal use of this command may originate from automation tools and frameworks.	t1033 _deprecated elastic
security tools and device drivers may run these programs in order to enumerate kernel modules. use of these programs by ordinary users is uncommon. these can be exempted by process name or username.	t1082 linux rules_building_block elastic
security tools and device drivers may run these programs in order to load legitimate kernel modules. use of these programs by ordinary users is uncommon.	t1547 _deprecated elastic
seen being triggered occasionally during windows 8 defender updates	t1562 t1562.001 windows sigma
sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.	azure aks kubernetes cluster aws eks kubernetes cluster gcp gke kubernetes cluster splunk
sensitive objects may be accessed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. sensitive objects accessed from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
sensitive role resource access is necessary for cluster operation, however source ip, namespace and user group may indicate possible malicious use.	azure aks kubernetes cluster aws eks kubernetes cluster splunk
serious issues with a configuration or plugin	t1499 t1499.004 sigma
servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior.	t1048 network elastic
service account being disabled or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	t1531 gcp sigma
service account being modified may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	gcp sigma
service account being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	t1531 azure sigma
service account disabled or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1531 gcp sigma
service account key deletions may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. key deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1098 gcp elastic
service account keys may be created by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1098 gcp elastic
service account misconfigured	t1078 t1078.004 t1110 azure sigma
service account modified from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	gcp sigma
service account modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1531 azure sigma
service accounts can be created by system administrators. verify that the behavior was expected. exceptions can be added to this rule to filter expected behavior.	t1136 gcp elastic
service accounts may be deleted by system administrators. verify that the behavior was expected. exceptions can be added to this rule to filter expected behavior.	t1531 gcp elastic
service accounts may be disabled by system administrators. verify that the behavior was expected. exceptions can be added to this rule to filter expected behavior.	t1531 gcp elastic
service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. filter as needed.	t1078 t1098 endpoint splunk
service accounts or applications that routinely query active directory for information.	t1087 t1087.002 endpoint splunk
service accounts used on legacy systems (e.g. netapp)	t1558 t1558.003 windows sigma
service principal being created may be performed by a system administrator.	azure sigma
service principal being removed may be performed by a system administrator.	azure sigma
service principal client credential modifications may be part of legitimate administrative operations. filter as needed.	t1098 t1098.001 azure active directory o365 tenant splunk
service principal created from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
service principal credential additions may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. credential additions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1496 azure elastic
service principal removed from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
service principals are sometimes configured to legitimately bypass the consent process for purposes of automation. filter as needed.	t1098.003 o365 tenant azure active directory splunk
service principals will legitimally authenticate remotely to your tenant. implementing this detection after establishing a baseline enables a more accurate identification of security threats, ensuring proactive and informed responses to safeguard the azure ad environment. source ips.	t1078.004 azure active directory splunk
services or tools that set the values to more restrictive values	t1112 t1562 t1562.001 windows sigma
setting the \"complus_etwenabled\" value as a global environment variable either in user or machine scope should only happens during debugging use cases, hence the false positives rate should be very minimal.	t1562 t1562.006 endpoint splunk
shared systems such as kiosks and conference room computers may be used by multiple users.	t1110 okta elastic
shell process that are not included in this search may cause false positive. filter is needed.	t1055 endpoint splunk
sign-ins using powershell may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be signing into your environment. sign-ins from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1078 azure elastic
similar to cve-2023-35078, the path for exploitation indicates that status=200 is required for successful exploitation of the vulnerability. false positives may be present if status=200 is removed from the search. if it is removed,then the search also alert on status=301 and status=404 which indicates unsuccessful exploitation attempts. analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability.	t1133 t1190 web server splunk
since the content of the files are unknown, false positives are expected	t1105 t1218 windows sigma
since the imageload event doesn't have enough information in this case. it's better to look at the recent process creation events that spawned the wmic process and investigate the command line and parent/child processes to get more insights	t1220 windows sigma
single-letter executables are not always malicious. investigate this activity with your normal incident-response process.	t1204 t1204.002 endpoint splunk
smart card enrollement	windows sigma
snapshots may be deleted by a system administrator. verify whether the user identity should be making changes in your environment. snapshot deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 aws elastic
socat is a dual-use tool that can be used for benign or malicious activity. some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. usage by web servers is more likely to be suspicious.	_deprecated elastic
software companies that bundle paexec with their software and rename it, so that it is less embarrassing	t1202 windows sigma
software companies that bundle psexec/paexec with their software and rename it, so that it is less embarrassing	t1587 t1587.001 windows sigma
software downloads	t1105 t1568 sigma
software installation	t1053 t1053.005 t1543 t1543.003 windows sigma
software installation iso files	t1566 t1566.001 windows sigma
software installations	t1562 t1562.004 windows sigma
software installations and removal	t1562 t1562.004 windows sigma
software installers	t1564 t1564.004 windows sigma
software installers downloaded and used by users	t1547 t1547.001 windows sigma
software installers that pull packages from remote systems and execute them	t1059 t1059.001 windows sigma
software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives	t1053 t1053.005 windows sigma
software that illegally integrates megasync in a renamed form	t1218 windows sigma
software that uses the appdata folder and scheduled tasks to update the software in the appdata folders	t1053 t1053.005 windows sigma
software that uses the caret encased keywords pass and user in its command line	t1110 t1110.001 windows sigma
software using weird folders for updates	t1547 t1547.001 windows sigma
some administrative powershell or vb scripts might have the ability to collect dumps and move them to other folders which might trigger a false positive.	windows sigma
some administrative tasks on remote host	t1021 t1021.003 t1047 rpc_firewall sigma
some administrator activity can be potentially triggered, please add those users to the filter macro.	t1003 t1036 t1036.005 t1595 endpoint splunk
some applications and users may legitimately use attrib.exe to interact with the files.	t1222 t1222.001 endpoint splunk
some build frameworks	t1496 windows sigma
some container images require the addition of privileged capabilities. this rule leaves space for the exception of trusted container images. to add an exception, add the trusted container image name to the query field, kubernetes.audit.requestobject.spec.containers.image.	T1610 t1611 kubernetes elastic
some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered	t1082 linux sigma
some crashes can occur sometimes and the event doesn't provide enough information to tune out these cases. manual exception is required	t1562 t1562.001 windows sigma
some false positive is expected from tools with similar command line flags.	windows sigma
some false positives are expected in some environment that may use this functionality to install and test their custom applications	t1059 windows sigma
some false positives are to be expected from uninstallers.	windows sigma
some false positives are to be expected on user or administrator machines. apply additional filters as needed.	t1565 t1565.001 linux sigma
some false positives could occur with the admin or guest account. it depends on the scripts being used by the admins in your env. if you experience a lot of fp you could reduce the level to medium	t1560 t1560.001 windows sigma
some false positives may arise in some environment and this may require some tuning. add additional filters or reduce level depending on the level of noise	t1059 t1059.001 t1069 t1069.001 t1069.002 t1087 t1087.001 t1087.002 t1482 windows sigma
some false positives may be present and will need to be filtered.	t1548 t1548.002 endpoint splunk
some false positives may occur with admin scripts that set wt settings.	t1547 t1547.015 windows sigma
some false positives may occur with legitimate renamed process explorer binaries	t1068 windows sigma
some false positives may occur with legitimate renamed process monitor binaries	t1068 windows sigma
some false positives may occur with other tools with similar commandlines	t1090 t1090.001 windows sigma
some false positives might occur with admin or third party software scripts. investigate and apply additional filters accordingly.	windows sigma
some false positives might occur with binaries download via github	t1564 t1564.004 windows sigma
some fp could occur with similar tools that uses the same command line '--set-password'	t1219 windows sigma
some fp may occur when the feature is disabled by the av itself, you should always investigate if the action was legitimate	t1562 t1562.001 windows sigma
some installers located in the temp directory might communicate with the github domains in order to download additional software. baseline these cases or move the github domain to a lower level hunting rule.	t1105 windows sigma
some installers may trigger some false positives	t1574 t1574.001 t1574.002 windows sigma
some installers might execute \"regsvr32\" with dlls located in %temp% or in %programdata%. apply additional filters if necessary.	t1218 t1218.010 windows sigma
some installers might generate a similar behavior. an initial baseline is required	t1059 t1059.005 t1059.007 windows sigma
some installers were seen using this method of creation unfortunately. filter them in your environment	t1053 t1053.005 windows sigma
some legacy applications may be run using pcalua.exe. filter these results as needed.	t1202 endpoint splunk
some legacy applications may be run using pcalua.exe. similarly, forfiles.exe may be used in legitimate batch scripts. filter these results as needed.	t1202 endpoint splunk
some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. filter as needed.	t1562 t1562.001 endpoint splunk
some legitimate applications may use a moved copy of msbuild.exe, triggering a false positive. baselining of msbuild.exe usage is recommended to better understand it's path usage. visual studio runs an instance out of a path that will need to be filtered on.	t1036 t1036.003 t1127 t1127.001 endpoint splunk
some legitimate applications may use plistbuddy to create or modify property lists and possibly generate false positives. review the property list being modified or created to confirm.	t1543 t1543.001 endpoint splunk
some legitimate applications start with long command lines.	endpoint splunk
some legitimate applications use long command lines for installs or updates. you should review identified command lines for legitimacy. you may modify the first part of the search to omit legitimate command lines from consideration. if you are seeing more results than desired, you may consider changing the value of threshold in the search to a smaller value. you should also periodically re-run the support search to re-build the ml model on the latest data. you may get unexpected results if the user identified in the results is not present in the data used to build the associated model.	endpoint splunk
some legitimate apps use this, but limited.	t1036 t1036.003 t1197 windows sigma
some legitimate printer-related processes may show up as children of spoolsv.exe. you should confirm that any activity as legitimate and may be added as exclusions in the search.	t1068 endpoint splunk
some legitimate processes may be only rarely executed in your environment.	t1204 endpoint splunk
some legitimate windows services	t1218 t1218.010 windows sigma
some native binaries and browser applications may request sedebugprivilege. filter as needed.	t1134 t1134.002 endpoint splunk
some network security policies allow rdp directly from the internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. rdp services may be exposed directly to the internet in some networks such as cloud environments. in such cases, only rdp gateways, bastions or jump servers may be expected expose rdp directly to the internet and can be exempted from this rule. rdp may be required by some work-flows such as remote access and support for specialized software products and servers. such work-flows are usually known and not unexpected.	t1021 t1190 network elastic
some network security policies allow ssh directly from the internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. ssh services may be exposed directly to the internet in some networks such as cloud environments. in such cases, only ssh gateways, bastions or jump servers may be expected expose ssh directly to the internet and can be exempted from this rule. ssh may be required by some work-flows such as remote access and support for specialized software products and servers. such work-flows are usually known and not unexpected.	t1021 t1190 _deprecated elastic
some networks may use kerberized ftp or telnet servers, however, this is rare.	endpoint splunk
some networks may utilize pptp protocols but this is uncommon as more modern vpn technologies are available. usage that is unfamiliar to local network administrators can be unexpected and suspicious. torrenting applications may use this port. because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server replies to a client that used this port by coincidence. this is uncommon but such servers can be excluded.	_deprecated elastic
some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server with a public ip address replies to a client which has used a udp port in the range by coincidence. this is uncommon but such servers can be excluded.	network elastic
some normal applications and scripts may contain no user agent. most legitimate web requests from the internet contain a user agent string. requests from web browsers almost always contain a user agent string. if the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity.	_deprecated elastic
some normal use of this command may originate from security engineers and network or server administrators, but this is usually not routine or unannounced. use of `nping` by non-engineers or ordinary users is uncommon.	t1046 linux elastic
some normal use of this command may originate from server or network administrators engaged in network troubleshooting.	t1040 _deprecated elastic
some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. usage by non-engineers and ordinary users is unusual.	t1033 windows elastic
some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)	t1112 windows sigma
some of these processes may be used legitimately on web servers during maintenance or other administrative tasks.	t1082 web server splunk
some organizations allow login with the root user without mfa, however, this is not considered best practice by aws and increases the risk of compromised credentials.	t1078 aws elastic
some powershell installers were seen using similar combinations. apply filters accordingly	t1059 windows sigma
some proxied applications may use these ports but this usually occurs in local traffic using private ips which this rule does not match. proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. if desired, internet proxy services using these ports can be added to allowlists. some screen recording applications may use these ports. proxy port activity involving an unusual source or destination may be more suspicious. some cloud environments may use this port when vpns or direct connects are not in use and cloud instances are accessed across the internet. because these ports are in the ephemeral range, this rule may false under certain conditions such as when a nated web server replies to a client which has used a port in the range by coincidence. in this case, such servers can be excluded if desired.	_deprecated elastic
some rare backup scenarios	t1003 t1003.002 windows sigma
some security products or third party applications may utilize createremotethread, filter as needed before enabling as a notable.	t1055 T1055.002 endpoint splunk
some security products seem to spawn these	t1036 t1036.003 t1036.005 windows sigma
some software may create wmi temporary event subscriptions for various purposes. the included search contains an exception for two of these that occur by default on windows 10 systems. you may need to modify the search to create exceptions for other legitimate events.	t1047 endpoint splunk
some software piracy tools (key generators, cracks) are classified as hack tools	t1588 windows sigma
some taskmgr.exe related activity	t1003 t1003.001 windows sigma
some tuning is required for other general purpose directories of third party apps	t1036 t1036.007 windows sigma
some tuning might be required to allow or remove certain locations used by the rule if you consider them as safe locations	t1204 t1204.002 windows sigma
some users and applications may leverage dynamic dns to reach out to some domains on the internet since dynamic dns by itself is not malicious, however this activity must be verified.	t1189 endpoint splunk
some vpn applications are known to launch netsh.exe. outside of these instances, it is unusual for an executable to launch netsh.exe and run commands.	t1090 t1090.001 t1562 t1562.004 endpoint splunk
spikes in error message activity can also be due to bugs in cloud automation scripts or workflows; changes to cloud automation scripts or workflows; adoption of new services; changes in the way services are used; or changes to iam privileges.	aws elastic
sql database being modified or deleted may be performed by a system administrator.	gcp sigma
sql database modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	gcp sigma
ssh connections may be made directly to internet destinations in order to access linux cloud server instances but such connections are usually made only by engineers. in such cases, only ssh gateways, bastions or jump servers may be expected internet destinations and can be exempted from this rule. ssh may be required by some work-flows such as remote access and support for specialized software products and servers. such work-flows are usually known and not unexpected. usage that is unfamiliar to server or network owners can be unexpected and suspicious.	_deprecated elastic
ssh over ports apart from the traditional port 22 is highly uncommon. this rule alerts the usage of the such uncommon ports by the ssh service. tuning is needed to have higher confidence. if this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination whitelisted ports for such legitimate ssh activities.	t1571 cross-platform elastic
ssh usage may be legitimate depending on the environment. access patterns and follow-on activity should be analyzed to distinguish between authorized and potentially malicious behavior.	t1021 t1133 cloud_defend elastic
standard domain users who are part of the administrator group. these users shouldn't have these right. but in the case where it's necessary. they should be filtered out using the \"targetusername\" field	windows sigma
static format arguments - https://petri.com/command-line-wmi-part-3	t1220 windows sigma
storage bucket configuration may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1578 gcp elastic
storage bucket permissions may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1222 gcp elastic
storage buckets being enumerated may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	gcp sigma
storage buckets being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	gcp sigma
storage buckets enumerated from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	gcp sigma
storage buckets may be deleted by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. bucket deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 gcp elastic
storage buckets modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	gcp sigma
strace is a dual-use tool that can be used for benign or malicious activity. some normal use of this command may originate from developers or sres engaged in debugging or system call tracing.	t1068 _deprecated elastic
sts:assumerole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. this search can be adjusted to provide specific values to identify cases of abuse.	t1078 aws account splunk
sts:getsessiontoken can be very noisy as in certain environments numerous calls of this type can be executed. this search can be adjusted to provide specific values to identify cases of abuse. in specific environments the use of field requestparameters.serialnumber will need to be used.	t1550 aws account splunk
subscription creations may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. subscription creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	T1530 gcp elastic
subscription deletions may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. subscription deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 gcp elastic
suppression rule being created may be performed by a system administrator.	azure sigma
suppression rule created from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
suppression rules can be created legitimately by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. suppression rules created by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 azure elastic
suspending the recording of a trail may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. trail suspensions from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
synchronization of templates	t1137 windows sigma
synergy software kvm (https://symless.com/synergy)	t1090 windows sigma
system administrator activities	t1486 t1564 t1564.002 t1565 windows aws sigma
system administrator creating powershell profile manually	t1546 t1546.013 windows sigma
system administrator usage	t1069 t1069.001 t1218 t1485 t1548 t1548.002 windows sigma
system administrators managing certificates.	t1552 t1552.004 windows sigma
system administrators may use looks like net.exe or \"dir commandline\" for troubleshooting or administrations tasks. however, this will typically come only from certain users and certain systems that can be added to an allow list.	t1135 endpoint splunk
system administrators may use looks like psexec for troubleshooting or administrations tasks. however, this will typically come only from certain users and certain systems that can be added to an allow list.	t1021 t1021.002 endpoint splunk
system administrators may use this option, but it's not common.	t1027 endpoint splunk
system administrators or scripts may delete user accounts via this technique. filter as needed.	t1531 endpoint splunk
system components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace	t1036 t1036.005 kubernetes sigma
system informer is regularly used legitimately by system administrators or developers. apply additional filters accordingly	t1082 t1543 t1564 windows sigma
system may lock or suspend user accounts.	onelogin sigma
system or network administrator behaviors	t1562 aws sigma
system processes copied outside their default folders for testing purposes	t1036 t1036.005 windows sigma
system provisioning (system reset before the golden image creation)	t1070 t1070.001 windows sigma
systems with names equal to the spoofed ones used by the brute force tools	t1110 windows sigma
takeown.exe is a normal windows application that may used by network operator.	t1222 endpoint splunk
task definition being modified to request credentials from the task metadata service for valid reasons	t1525 aws sigma
teams external access may be enabled by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1098 o365 elastic
teams guest access may be enabled by a system or network administrator. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1098 o365 elastic
telnet can be used for both benign or malicious purposes. telnet is included by default in some linux distributions, so its presence is not inherently suspicious. the use of telnet to manage devices remotely has declined in recent years in favor of more secure protocols such as ssh. telnet usage by non-automated tools or frameworks may be suspicious.	t1021 linux elastic
testing updates to compliance policies.	aws_bedrock elastic
the activity may be legitimate. for this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. if your local administrator group name is not \"administrators\", this search may generate an excessive number of false positives	t1136 t1136.001 windows splunk
the activity may be legitimate. other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. in these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.	t1003 t1003.001 windows splunk
the activity may be legitimate. powershell is often used by administrators to perform various tasks, and it's possible this event could be generated in those cases. in these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.	t1003.001 windows splunk
the build engine is commonly used by windows developers but use by non-engineers is unusual.	t1003 t1036 t1055 t1059 t1127 t1555 windows elastic
the canon myprinter folder 'c:\program files\canon\myprinter\' is known to contain the 'log.dll' file	t1574 t1574.001 t1574.002 windows sigma
the command wmic os get lastboottuptime loads vbscript.dll	t1220 windows sigma
the command wmic os get locale loads vbscript.dll	t1220 windows sigma
the creation of a new federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.	t1136 t1136.003 o365 tenant splunk
the creation of a new federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.	t1136 t1136.003 o365 tenant splunk
the creation of a new federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.	t1136 t1136.003 o365 tenant splunk
the daemonset controller creates pods with hostpath volumes within the kube-system namespace.	t1611 kubernetes sigma
the default group policy objects within an ad network may be legitimately updated for administrative operations, filter as needed.	t1484 t1484.001 endpoint splunk
the deletionprotection feature must be disabled as a prerequisite for deletion of a db instance or cluster. ensure that the instance should not be modified in this way before taking action.	t1485 aws elastic
the event doesn't contain information about the type of change. false positives are expected with legitimate changes	windows sigma
the false-positive rate may vary based on the values of`datapointthreshold` and `deviationthreshold`. please modify this according the your environment.	t1562.007 aws instance splunk
the false-positive rate will vary based on how you set the deviation_threshold and data_samples values. our recommendation is to adjust these values based on your network traffic to and from your email servers.	t1114 T1114.002 endpoint splunk
the full_access_as_app api permission may be assigned to legitimate applications. filter as needed.	T1098.002 t1098.003 azure active directory o365 tenant splunk
the guardduty detector may be deleted by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. detector deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
the html help executable program (hh.exe) runs whenever a user clicks a compiled help (.chm) file or menu item that opens the help file inside the help viewer. this is not always malicious, but adversaries may abuse this technology to conceal malicious code.	t1204 t1218 windows elastic
the idea of using named pipes with cobalt strike is to blend in. therefore, some of the named pipes identified and added may cause false positives. filter by process name or pipe name to reduce false positives.	t1055 endpoint splunk
the installation of new screen savers by third party software	t1218 t1218.011 windows sigma
the jsp file names are static names used in current proof of concept code. =	t1133 t1190 t1505 t1505.003 web server splunk
the kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret	t1552 t1552.007 kubernetes sigma
the lookup file `browser_app_list` may not contain all the browser applications that are allowed to access the browser user data profiles. consider updating the lookup files to add allowed object paths for the browser applications that are not included in the lookup file.	t1012 endpoint splunk
the main source of false positives could be the legitimate use of scheduled tasks from these directories. careful tuning of this search may be necessary to suit the specifics of your environment, reducing the rate of false positives.	t1053 t1053.005 endpoint splunk
the number of okta user password reset or account unlock attempts will likely vary between organizations. to fit this rule to their organization, users can duplicate this rule and edit the schedule and threshold values in the new rule.	t1078 okta elastic
the occurrence of false positives should be minimal, given that the sql agent does not typically download software using certutil.	t1105 endpoint splunk
the old auditpol utility isn't available by default on recent versions of windows as it was replaced by a newer version. the fp rate should be very low except for tools that use a similar flag structure	t1562 t1562.002 windows sigma
the process spawned by vsjitdebugger.exe is uncommon.	t1218 windows sigma
the proof of concept exploit script indicates that status=200 is required for successful exploitation of the vulnerability. false positives may be present if status=200 is removed from the search. if it is removed,then the search also alert on status=301 and status=404 which indicates unsuccessful exploitation attempts. analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability.	t1133 t1190 web server splunk
the query is structured in a way that `action` (read, create) is not defined. review the results of this query, filter, and tune as necessary. it may be necessary to generate this query specific to your endpoint product.	t1133 t1190 t1505 t1505.003 t1566 t1566.001 endpoint splunk
the rule doesn't look for anything suspicious so false positives are expected. if you use one of the tools mentioned, comment it out	t1543 t1543.003 t1569 t1569.002 windows sigma
the rule is looking for any usage of response file, which might generate false positive when this function is used legitimately. investigate the contents of the \".rsp\" file to determine if it is malicious and apply additional filters if necessary.	t1218 t1218.008 windows sigma
the same functionality can be implemented by admin scripts, correlate with name and creator	t1020 windows sigma
the sourceanchor (also called immutableid) azure ad attribute has legitimate uses for directory synchronization. investigate and filter as needed.	t1098 azure active directory splunk
the threshold for alert is above 10 attempts and this should reduce the number of false positives.	t1110 o365 tenant splunk
the uninstallation of a large software application or the use of cleanmgr.exe may trigger this detection. a filter is necessary to reduce false positives.	t1485 endpoint splunk
the wevtutil.exe application is a legitimate windows event log utility. administrators may use it to manage windows event logs.	t1070 t1070.001 endpoint splunk
the wmic.exe utility is a benign windows application. it may be used legitimately by administrators with these parameters for remote system administration, but it's relatively uncommon.	t1047 endpoint splunk
there are circumstances where an application may legitimately execute and interact with the windows command-line interface. investigate and modify the lookup file, as appropriate.	t1059 t1059.003 endpoint splunk
there are legitimate scenarios in wich an application registrations requires mailbox read access. filter as needed.	t1098 t1098.003 t1114 T1114.002 o365 tenant splunk
there are legitimate uses of ssm to send commands to ec2 instances	t1566 t1566.002 aws sigma
there are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications	t1546 t1546.011 endpoint splunk
there are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.	t1547 t1547.001 endpoint splunk
there are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task.	t1546 t1546.012 endpoint splunk
there are many legitimate reasons to stop a service. this rule isn't looking for any suspicious behaviour in particular. filter legitimate activity accordingly	t1489 windows sigma
there are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation. modify the static value distinct_detection_name to a higher value. it is also required to tune analytics that are also tagged to ensure volume is never too much.	t1059 t1105 t1133 t1190 endpoint splunk
there are no known false positives.	endpoint splunk
there is a possibility that a user may accidentally click on the wrong application, which could trigger this event. it is advisable to verify the location from which this activity originates.	t1087.004 okta tenant splunk
there is a potential for false positives if the container is used for legitimate administrative tasks that require the use of container management utilities, such as deploying, scaling, or updating containerized applications. it is important to investigate any alerts generated by this rule to determine if they are indicative of malicious activity or part of legitimate container activity.	t1609 cloud_defend elastic
there is a relevant set of false positives depending on applications in the environment	t1543 t1543.003 windows sigma
there is usually no reason to remove modules, but some buggy modules require it. these can be exempted by username. note that some linux distributions are not built to support the removal of modules at all.	t1547 t1562 linux elastic
there legitimate reasons to export certificates. investigate the activity to determine if it's benign	t1027 windows sigma
there may be a faulty config preventing legitmate users from accessing apps they should have access to.	t1078 t1078.001 infrastructure splunk
there may be false positives generated due to the reliance on version numbers for identification purposes. despite this limitation, the primary goal of this approach is to aid in the detection of the software within the environment.	T1195.002 endpoint splunk
there may be legitimate reasons for administrators to add a certificate to the untrusted certificate store. in such cases, this will typically be done on a large number of systems.	t1553 t1553.004 endpoint splunk
there may be legitimate reasons for system administrators to add entries to this file.	endpoint splunk
there may be legitimate reasons to bypass the powershell execution policy. the powershell script being run with this parameter should be validated to ensure that it is legitimate.	t1059 t1059.001 endpoint splunk
there may be other processes in your environment that users may legitimately use to modify file associations. if this is the case and you are finding false positives, you can modify the search to add those processes as exceptions.	t1546.001 endpoint splunk
there maybe buckets provisioned with s3 encryption	t1486 s3 bucket splunk
there might be false positives associted with this detection since items like args as a web argument is pretty generic.	t1133 t1505.003 web server splunk
there might be some false positives as keyboard event taps are used by processes like siri and zoom video chat, for some good examples of processes to exclude please see [this](https://github.com/facebook/osquery/pull/5345#issuecomment-454639161) comment.	endpoint splunk
there will be limited false positives and it will be different for every environment. tune by child process or command-line as needed.	t1566 t1566.001 endpoint splunk
these characters might be legitimately on the command-line, but it is not common.	t1059 t1059.001 endpoint splunk
these programs may be used by windows developers but use by non-engineers is unusual.	t1127 _deprecated elastic
third party antivirus	t1562 t1562.001 windows sigma
third party application may use this approach to uninstall applications.	t1562 t1562.001 endpoint splunk
third party application may use this network protocol as part of its feature. filter is needed.	t1071 T1071.003 endpoint splunk
third party application may use this proxies if allowed in production environment. filter is needed.	t1071 T1071.003 endpoint splunk
third party application may used this dll export name to execute function.	t1218 t1218.011 endpoint splunk
third party legitimate application may load this task schedule dll module.	t1053 endpoint splunk
third party rdp tools	t1021 t1021.001 windows sigma
third party software may access this outlook registry.	t1552 endpoint splunk
third party software might bundle specific versions of system dlls.	t1036 t1036.005 windows sigma
third party software might leverage this dll in order to make use of the credential manager feature via the provided exports. typically the vaultcli.dll module is loaded by the vaultcmd.exe windows utility to interact with the windows credential manager for secure storage and retrieval of credentials.	t1555.004 endpoint splunk
third party software naming their software with the same names as the processes mentioned here	t1036 t1036.005 windows sigma
third party tool may have same command line parameters as revil ransomware.	t1204 endpoint splunk
third party tools may used this technique to create services but not so common.	t1574.011 endpoint splunk
this analytic is limited to http status 200; adjust as necessary. false positives may occur if the uri path is ip-restricted or externally blocked. it's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.	t1190 vpn appliance network splunk
this analytic is meant to assist with hunting modules across a fleet of iis servers. filter and modify as needed.	t1505 t1505.004 endpoint splunk
this analytic is meant to assist with identifying drivers loaded in the environment and not to be setup for notables off the bat.	t1014 t1068 endpoint splunk
this analytic may also capture legitimate administrative activities such as system updates or maintenance tasks, which can be classified as false positives. filter as needed.	t1053 t1053.005 endpoint splunk
this analytic may flag instances where dlls are loaded by user mode programs for entirely legitimate and benign purposes. it is important for users to be aware that false positives are not only possible but likely, and that careful tuning of this analytic is necessary to distinguish between malicious activity and normal, everyday operations of applications. this may involve adjusting thresholds, whitelisting known good software, or incorporating additional context from other security tools and logs to reduce the rate of false positives.	t1574 t1574.001 t1574.002 endpoint splunk
this analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. filter as needed.	t1218.007 endpoint splunk
this behavior is not commonly seen in production environment and not advisable, filter as needed.	t1489 endpoint splunk
this behavior may be noisy, as these cmdlets are commonly used by system administrators or other legitimate users to manage services. therefore, it is recommended not to enable this analytic as a direct notable or ttp. instead, it should be used as part of a broader set of security controls to detect and investigate potential threats.	t1059.001 endpoint splunk
this behavior may seen in normal transfer of file within network if network share is common place for sharing documents.	t1537 endpoint splunk
this commandline can be used by a network administrator to audit host machine specifications. thus, a filter is needed.	t1592 endpoint splunk
this detection can catch for third party application updates or installation. in this scenario false positive filter is needed.	t1112 endpoint splunk
this detection cloud be noisy depending on the environment. it is recommended to keep a check on the new secrets when created and validate the \"actor\".	t1078 t1078.004 github sigma
this detection is low-volume and is seen infrequently in most organizations. when this detection appears it's high risk, and users should be remediated.	t1528 azure sigma
this detection may also be triggered by legitimate applications and numerous service accounts, which often end with a $ sign. to manage this, it's advised to check the service account's activities and, if they are valid, modify the filter macro to exclude them.	t1059 t1059.003 endpoint splunk
this detection may generate a few false positives, such as legitimate software updates or legitimate system maintenance activities that modify the runmru key. however, the exclusion of mrulist value changes helps reduce the number of false positives by focusing only on actual command entries. add any specific false positives to the built in filter to reduce notables as needed.	t1202 endpoint splunk
this detection may require tuning based on third party applications utilizing native windows binaries in non-standard paths.	t1036 t1036.003 endpoint splunk
this detection may yield false positives in scenarios where legitimate bulk sign-in activities occur, such as during company-wide system updates or when users are accessing resources from varying locations in a short time frame, such as in the case of vpns or cloud services that rotate ip addresses. filter as needed.	t1110 T1110.003 T1110.004 t1586 t1586.003 azure tenant o365 tenant splunk
this detection model will alert on any sender domain that is seen for the first time. this could be a potential false positive. the next step is to investigate and add the url to an allow list if you determine that it is a legitimate sender.	t1566 endpoint splunk
this detection should yield little or no false positive results. it is uncommon for lnk files to be executed from temporary or user directories.	t1566 t1566.002 endpoint splunk
this detection will require tuning to provide high fidelity detection capabilties. tune based on src addresses (corporate offices, vpn terminations) or by groups of users. not every user with aws access should have permission to delete policies (least privilege). in addition, this may be saved seperately and tuned for failed or success attempts only.	t1098 aws account splunk
this event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry, but it is still recommended to check this alert with high priority.	t1489 endpoint splunk
this event could stem from users changing an account's password that's used to authenticate via a job or an automated process. investigate the source of such events and mitigate them	t1110 windows sigma
this event is really notable but we found minimal number of normal application from system32 folder like svchost.exe accessing it too. in this case we used 'system32' and 'syswow64' path as a filter for this detection.	t1561 t1561.002 endpoint splunk
this event should only fire when an administrator is modifying the audit policy. which should be a rare occurrence once it's set up	windows sigma
this hunting analytic is meant to assist with baselining and understanding headless browsing in use. filter as needed.	t1564.003 endpoint splunk
this is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment.	t1218 t1218.011 endpoint splunk
this is a strictly behavioral search, so we define \"false positive\" slightly differently. every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. but while there are really no \"false positives\" in a traditional sense, there is definitely lots of noise. this search will fire any time a new ip address is seen in the geoip database for any kind of provisioning activity. if you typically do all provisioning from tools inside of your country, there should be few false positives. if you are located in countries where the free version of maxmind geoip that ships by default with splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.	t1078 aws instance splunk
this is an anomaly search, you must specify your domain in the parameters so it either filters outside domains or focus on internal domains. this search may also help investigate compromise of accounts. by looking at for example source ip addresses, document titles and abnormal number of shares and shared target users.	t1566 gdrive splunk
this is an intentional action taken by aws in the event of compromised credentials. follow the instructions specified in the support case created for you regarding this event.	t1552 aws elastic
this is likely to produce false positives and will require some filtering. tune the query by adding command line paths to known good dlls, or filtering based on parent process names.	t1218 t1218.011 endpoint splunk
this is meant to be a low risk rba anomaly analytic or to be used for hunting. enable this with a low risk score and let it generate risk in the risk index.	t1059.001 endpoint splunk
this is meant to run only on datasources using elastic agent 7.14+ since versions prior to that will be missing the necessary field, resulting in false positives.	t1036 cross-platform elastic
this is not a common command to be executed. filter as needed.	t1021.004 endpoint splunk
this is very uncommon behavior and should result in minimal false positives, ensure validity of the triggered event and include exceptions where necessary.	t1021 t1550 aws elastic
this may be tuned, or a new one related, by adding .cpl to command-line. however, it's important to look for both. tune/filter as needed.	t1218 t1218.011 endpoint splunk
this may have false positives on hosts where virtualbox is legitimately being used for operations	t1564 t1564.006 windows sigma
this model is an anomaly detector that identifies usage of apis and scripting constructs that are correllated with malicious activity. these apis and scripting constructs are part of the programming langauge and advanced scripts may generate false positives.	t1059.003 endpoint splunk
this module can be loaded by a third party application. filter is needed.	t1003 t1056 t1056.002 t1219 t1589 T1589.001 endpoint splunk
this process should not be ran forcefully, we have not see any false positives for this detection	t1059.003 endpoint splunk
this registry key may be modified via administrators to implement a change in system policy. this type of change should be a very rare occurrence.	t1548 t1548.002 endpoint splunk
this rule could generate false positives if the process arguments leveraged by the exploit are shared by custom scripts using the sudo or sudoedit binaries. only sudo versions 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1 are affected; if those versions are not present on the endpoint, this could be a false positive.	t1068 cross-platform elastic
this rule could identify benign domains that are formatted similarly to fin7's command and control algorithm. alerts should be investigated by an analyst to assess the validity of the individual observations.	t1071 t1568 network elastic
this rule does not indicate that a sql injection attack occurred, only that the `sqlmap` tool was used. security scans and tests may result in these errors. if the source is not an authorized security tester, this is generally suspicious or malicious activity.	apm elastic
this rule doesn't exclude other known tlds such as \".org\" or \".net\". it's recommended to apply additional filters for software and scripts that leverage the bits service	t1197 windows sigma
this rule is best put in testing first in order to create a baseline that reflects the data in your environment.	t1055 windows sigma
this rule is not looking for threat activity. disable the rule if you're already familiar with alerts.	cross-platform elastic
this rule is to explore new applications on an endpoint. false positives depends on the organization.	t1204 t1204.002 windows sigma
this rule isn't looking for any particular binary characteristics. as legitimate installers and programs were seen embedding hidden binaries in their ads. some false positives are expected from browser processes and similar.	t1564 t1564.004 windows sigma
this rule should be tailored to either exclude systems, as sources or destinations, in which this behavior is expected.	t1071 t1568 network elastic
this rule should be tailored to exclude systems, either as sources or destinations, in which this behavior is expected.	t1071 t1568 network elastic
this rule was tuned using the following baseline: https://raw.githubusercontent.com/microsoft/css-exchange/main/security/baselines/baseline_15.2.792.5.csv from microsoft. depending on version, consult https://github.com/microsoft/css-exchange/tree/main/security/baselines to help determine normalcy.	t1190 t1210 windows elastic
this search can give false positives as there might be inherent issues with authentications and permissions at cluster.	azure aks kubernetes cluster aws eks kubernetes cluster gcp gke kubernetes cluster splunk
this search may trigger false positives if there is a legitimate reason for a high volume of bytes out to a url. we recommend to investigate these findings. consider updating the filter macro to exclude the applications that are relevant to your environment.	t1567 endpoint splunk
this search might be prone to high false positives if dhcp snooping has been incorrectly configured or in the unlikely event that the dhcp server has been moved to another network interface.	t1200 t1498 t1557 infrastructure splunk
this search might be prone to high false positives if dhcp snooping or arp inspection has been incorrectly configured, or if a device normally sends many arp packets (unlikely).	t1200 t1498 t1557 T1557.002 infrastructure splunk
this search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.	t1200 t1498 t1557 T1557.002 infrastructure splunk
this search might be prone to high false positives. please consider this when conducting analysis or investigations. authorized devices may be detected as unauthorized. if this is the case, verify the mac address of the system responsible for the false positive and add it to the assets and identity framework with the proper information.	infrastructure splunk
this search will also produce normal activity statistics. fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away phishing intent.for more specific results use email parameter.	t1566 gsuite splunk
this search will also report any legitimate attempts of software downloads to network devices as well as outbound ssh sessions from network devices.	t1542 T1542.005 infrastructure splunk
this search will return false positives for any legitimate traffic captures by network administrators.	t1020 T1020.001 t1200 t1498 infrastructure splunk
this technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out.	endpoint splunk
this tool was designed for home usage and not commonly seen in production environment. filter as needed.	t1021 t1021.001 endpoint splunk
this value is not set by default but could be rarly used by administrators	windows sigma
this will alert on legitimate macro usage as well, additional tuning is required	t1566 t1566.001 windows sigma
this windows feature may implement by administrator in some server where shutdown is critical. in that scenario filter of machine and users that can modify this registry is needed.	t1112 endpoint splunk
this windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, in this type of scenario filter is needed to minimized false positive.	t1112 endpoint splunk
to be determined	t1003 t1003.003 windows sigma
to tune this rule, add exceptions to exclude any event.code which should not trigger this rule.	t1078 cyberarkpas elastic
to tune this rule, add exceptions to exclude any google_workspace.alert.type which should not trigger this rule.	google_workspace elastic
tools that use similar command line flags and values	t1110 t1110.002 windows sigma
tools with similar commandline (very rare)	t1046 t1135 windows sigma
topic creations may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. topic creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	T1530 gcp elastic
topic deletions may be done by a system or network administrator. verify whether the user email, resource name, and/or hostname should be making changes in your environment. topic deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 gcp elastic
tor client activity is uncommon in managed enterprise networks but may be common in unmanaged or public networks where few security policies apply. because these ports are in the ephemeral range, this rule may false under certain conditions such as when a nated web server replies to a client which has used one of these ports by coincidence. in this case, such servers can be excluded if desired.	t1090 _deprecated elastic
traffic mirroring may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. traffic mirroring from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1020 t1074 aws elastic
trail creations may be made by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. trail creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	T1530 aws elastic
trail deletions may be made by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. trail deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
trail updates may be made by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. trail updates from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	T1530 t1565 aws elastic
transferring sensitive files for legitimate administration work by legitimate administrator	t1003 t1003.001 t1003.002 t1003.003 zeek windows sigma
trusted applications for managing calendars and reminders.	t1546 macos elastic
trusted applications persisting via launchagent	t1543 macos elastic
trusted applications persisting via launchdaemons	t1543 macos elastic
trusted domains may be added by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 google_workspace elastic
trusted finder sync plugins	t1543 macos elastic
trusted openssh executable updates. it's recommended to verify the integrity of openssh binary changes.	t1021 t1543 t1556 t1563 linux elastic
trusted solarwinds child processes. verify process details such as network connections and file writes.	t1059 t1195 windows elastic
trusted system module updates or allowed pluggable authentication module (pam) daemon configuration changes.	t1543 t1556 cross-platform linux elastic
trusted system or adobe acrobat related processes.	t1068 macos elastic
tune based on assets if possible, or restrict to known confluence servers. remove the ${ for a more broad query. to identify more exec, remove everything up to the last parameter (runtime().exec) for a broad query.	t1133 t1190 t1505 web server splunk
typically seen used to `encode` files, but it is possible to see legitimate use of `decode`. filter based on parent-child relationship, file paths, endpoint or user.	t1140 endpoint splunk
typically, this will not trigger because, by its very nature, installutil does not require credentials. filter as needed.	t1218 T1218.004 endpoint splunk
typos	linux sigma
udl files serve as a convenient and flexible tool for managing and testing database connections in various development and administrative scenarios.	t1071 t1218 t1218.011 windows sigma
unauthorized requests from service accounts are highly abnormal and more indicative of human behavior or a serious problem within the cluster. this behavior should be investigated further.	T1613 kubernetes elastic
uncommon but legitimate windows administrator or software tasks that make use of the encrypting file system rpc calls. verify if this is common activity (see description).	t1187 t1557 t1557.001 zeek sigma
uncommon compiler activity can be due to an engineer running a local build on a production or staging instance in the course of troubleshooting or fixing a software issue.	t1588 ml elastic
uncommon sudo activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.	t1548 ml elastic
uncommon user activity can be due to an administrator or help desk technician logging onto a workstation or server in order to perform manual troubleshooting or reconfiguration.	t1078 ml elastic
uncommon user activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.	t1078 ml elastic
uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.	t1016 t1033 t1049 t1057 t1082 ml elastic
uncommon user privilege elevation activity can be due to an administrator, help desk technician, or a user performing manual troubleshooting or reconfiguration.	ml elastic
uncommon username activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration.	t1078 ml elastic
unikely	t1218 t1218.003 windows sigma
uninstall application may access this registry to remove the entry of the target application. filter is needed.	t1012 endpoint splunk
uninstall chrome application may access this file and folder path to removed chrome installation in target host. filter is needed.	t1012 endpoint splunk
uninstall chrome browser extension application may access this file and folder path to removed chrome installation in the target host. filter is needed.	t1012 endpoint splunk
uninstall or manual deletion of a legitimate printing driver files. verify the printer file metadata such as manufacturer and signature information.	t1068 windows elastic
uninstallers may access this registry to remove the entry of the target application. filter as needed.	t1012 endpoint splunk
unknown	o365 elastic
unknown (data set is too small; further testing needed)	t1546 t1546.003 windows sigma
unknown as it may vary from organisation to organisation how admins use to install iis modules	t1505 t1505.003 windows sigma
unknown binary names of teamviewer	t1219 windows sigma
unknown cases in which werfault accesses lsass.exe	t1003 t1003.001 windows sigma
unknown flash download locations	t1036 t1036.005 t1189 t1204 t1204.002 sigma
unknown how many legitimate software products use that method	t1548 t1548.002 windows sigma
unknown sub processes of wsreset.exe	t1548 t1548.002 windows sigma
unknown. feedback welcomed.	t1187 windows sigma
unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored.	t1059.004 endpoint splunk
unless it is a special case, it is uncommon to continually update trusted ips to mfa configuration.	t1562 t1562.007 o365 tenant splunk
unless it is a special case, it is uncommon to disable mfa or strong authentication	t1556 o365 tenant splunk
unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. extraction of certificate has been observed during attacks such as golden saml and other campaigns targeting federated services.	endpoint splunk
unlikely	t1003 t1003.001 t1003.002 t1003.004 t1003.005 t1003.006 t1005 t1007 t1008 t1012 t1014 t1016 t1018 t1021 t1021.002 t1021.003 t1021.006 t1027 t1027.005 t1033 t1036 t1036.003 t1036.005 t1036.007 t1041 t1046 t1047 t1048 t1048.001 t1053 t1053.003 t1053.005 t1055 t1055.001 t1056 t1057 t1059 t1059.001 t1059.002 t1059.003 t1068 t1070 t1071 t1071.001 t1071.004 t1078 t1082 t1083 t1087 t1090 t1090.001 t1090.003 t1105 t1106 t1112 t1115 t1123 t1127 t1132 t1132.001 t1133 t1134 t1134.001 t1134.002 t1134.004 t1136 t1136.001 t1136.002 t1137 t1137.002 t1140 t1190 t1202 t1203 t1204 t1210 t1213 t1213.003 t1216 t1218 t1218.001 t1218.008 t1218.010 t1218.011 t1218.013 t1219 t1486 t1489 t1490 t1496 t1498 t1499 t1499.001 t1505 t1505.003 t1526 t1528 t1543 t1543.003 t1546 t1546.008 t1546.015 t1548 t1548.003 t1550 t1550.003 t1552 t1552.004 t1553 t1553.004 t1555 t1556 t1557 t1557.001 t1558 t1558.003 t1562 t1562.001 t1562.002 t1562.010 t1564 t1564.004 t1566 t1569 t1569.002 t1570 t1574 t1574.001 t1574.002 t1586 t1587 t1587.001 t1588 t1588.002 t1590 t1590.001 t1590.002 t1620 t1649 windows opencanary okta m365 azure bitbucket macos linux sigma
unlikely (at.exe deprecated as of windows 8)	t1053 t1053.002 windows sigma
unlikely but if you experience fps add specific processes and locations you would like to monitor for	windows sigma
unlikely in most cases, further investigation should be done in the commandline of the browser process to determine the context of the url accessed.	t1204 t1204.002 windows sigma
unlikely in production environment	windows sigma
unlikely, because no one should dump an lsass process memory	t1003 t1003.001 t1036 windows sigma
unlikely, because no sane admin pings ip addresses in a hexadecimal form	t1027 t1140 windows sigma
unlikely, but can rarely occur. apply additional filters accordingly.	t1218 t1218.010 windows sigma
unlikely, there could be conferencing software running from a temp folder accessing the devices	t1123 t1125 windows sigma
unlikely. except due to misconfigurations	t1078 t1110 t1557 cisco juniper huawei sigma
update the excluded named pipe to filter out any newly observed legit named pipe	t1021 t1021.002 zeek windows sigma
update_known_false_positives	t1528 azure tenant splunk
updated windows application needed in safe boot may used this registry	t1547 t1547.001 endpoint splunk
updates to approved and trusted ssh executables can trigger this rule.	t1554 t1556 linux elastic
updating a saml provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.	t1078 aws federated account splunk
usage of chrome extensions in testing tools such as burpsuite will trigger this alert	t1176 windows sigma
use of get-command and get-help modules to reference invoke-webrequest and start-bitstransfer.	t1059 t1059.001 windows sigma
use of program compatibility troubleshooter helper	t1218 t1218.011 windows sigma
used by microsoft sql server management studio	t1059 t1059.001 windows sigma
used by some .net binaries, minimal on user workstation.	t1059 t1059.001 windows sigma
user accounts can be used as service accounts and have their password set never to expire. this is a bad security practice that exposes the account to credential access attacks. for cases in which user accounts cannot be avoided, microsoft provides the group managed service accounts (gmsa) feature, which ensures that the account password is robust and changed regularly and automatically.	t1098 windows elastic
user accounts that are rarely active, such as a site reliability engineer (sre) or developer logging into a production server for troubleshooting, may trigger this alert. under some conditions, a newly created user account may briefly trigger this alert while the model is learning.	t1078 ml elastic
user activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste)	t1071 t1071.001 t1102 t1102.001 t1102.003 sigma
user and network administrator can execute this command.	t1070 t1560 t1560.001 endpoint splunk
user and network administrator may used this function to add trusted host.	t1021 t1021.006 endpoint splunk
user changing to a new device, location, browser, etc.	t1078 azure sigma
user genuinely creates a vb macro for their email	t1008 t1137 t1546 windows sigma
user group access may be modified by an administrator to allow external access for community purposes. doing so for a user group whom has access to sensitive information or operational resources should be monitored closely.	t1098 _deprecated elastic
user has been put in acception group so they can use legacy authentication	t1078 t1078.004 t1110 azure sigma
user interacting with files permissions (normal/daily behaviour).	t1222 t1222.002 linux sigma
user may choose to disable windows defender av	t1562 t1562.001 endpoint splunk
user may execute and use this application	t1070 t1070.004 t1485 endpoint splunk
user might of believe that they had access.	okta sigma
user removed from the group is approved	t1548 t1556 azure sigma
user searches in search boxes of the respective website	t1189 t1190 t1221 t1505 t1505.003 sigma
user using a disabled account	t1078 windows sigma
user using a new mail client.	t1078 o365 elastic
user using a vpn may lead to false positives.	t1078 o365 elastic
user using a vpn or proxy	t1573 m365 sigma
users actually login but miss-click into the deny button when mfa prompt.	t1078 t1078.004 t1110 t1621 azure sigma
users allowed to perform these modifications (user found in field subjectusername)	t1484 t1484.001 windows sigma
users and administrators can create inbox rules for legitimate purposes. verify if it complies with the company policy and done with the user's consent. exceptions can be added to this rule to filter expected behavior.	t1114 o365 elastic
users emailing for legitimate business purposes that appear suspicious.	t1114 T1114.003 o365 tenant splunk
users may create email forwarding rules for legitimate purposes. filter as needed.	t1114 T1114.003 o365 tenant splunk
users may delete a large number of pictures or files in a folder, which could trigger this detection. additionally, heavy usage of powerbi and outlook may also result in false positives.	t1485 endpoint splunk
users may deny consent for legitimate applications by mistake, filter as needed.	t1528 azure tenant splunk
users may genuinely mistype or forget the password.	t1110 t1110.001 t1586 t1586.003 aws account splunk
users may genuinely reset the rds password.	t1110 t1586 t1586.003 aws account splunk
users may legitimately access aws systems manager (ssm) parameters using the getparameter, getparameters, or describeparameters api actions with credentials in the request parameters. ensure that the user has a legitimate reason to access the parameters and that the credentials are secured.	t1555 aws elastic
users may register mfa methods legitimally, investigate and filter as needed.	t1098 t1098.005 o365 tenant azure tenant splunk
users may share an endpoint related to work or personal use in which separate okta accounts are used.	t1110 okta elastic
users or system administrator cleaning out folders.	t1485 o365 elastic
users running scripts in the course of technical support operations of software upgrades could trigger this alert. a newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert.	t1543 ml elastic
users testing new model deployments or updated compliance policies without amazon bedrock guardrails.	aws_bedrock elastic
users that debug microsoft intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension	t1587 t1587.001 windows sigma
users working late, or logging in from unusual time zones while traveling, may trigger this rule.	t1078 ml elastic
users working with these data types or exchanging message files	t1039 zeek windows sigma
using an ip address that is shared by many users	t1090 azure sigma
using multiple aws accounts and roles is perfectly valid behavior. it's suspicious when an account requests privileges of an account it hasn't before. you should validate with the account owner that this is a legitimate request.	aws instance splunk
using sc.exe to manipulate windows services is uncommon. however, there may be legitimate instances of this behavior. it is important to validate and investigate as appropriate.	t1543 t1543.003 endpoint splunk
utilization of this tool should not be seen in enterprise environment	t1027 t1027.004 windows sigma
valid change	t1003 t1098 t1098.003 azure sigma
valid change in a trail	t1562 t1562.001 aws sigma
valid change in aws config service	t1562 t1562.001 aws sigma
valid change in the guardduty (e.g. to ignore internal scanners)	t1562 t1562.001 aws sigma
valid change to a snapshot's permissions	t1537 aws sigma
valid changes to the startup script	t1059 t1059.001 t1059.003 t1059.004 aws sigma
valid clusters may be created by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. cluster creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1133 aws elastic
valid clusters or instances may be stopped by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. cluster or instance stoppages from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1489 aws elastic
valid dc sync that is not covered by the filters; please report	t1003 t1003.006 windows sigma
valid on domain controllers; exclude known dcs	t1207 windows sigma
valid requests with this exact user agent to server scripts of the defined names	t1071 t1071.001 sigma
valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations	t1567 t1567.002 sigma
valid usage of s3 browser for iam loginprofile listing and/or creation	t1059 t1059.009 t1078 t1078.004 aws sigma
valid usage of s3 browser for iam user and/or accesskey creation	t1059 t1059.009 t1078 t1078.004 aws sigma
valid usage of s3 browser with accidental creation of default inline iam policy without changing default s3 bucket name placeholder value	t1059 t1059.009 t1078 t1078.004 aws sigma
valid user connecting using rdp	t1003 t1003.001 windows sigma
valid user was not added to rdp group	t1021 t1021.001 windows sigma
valid usernames with high entropy or source/destination system pairs with multiple authenticating users will make it difficult to identify the real user authenticating.	t1078.003 t1552.001 endpoint splunk
validate the actor if permitted to access the repo.	t1098 t1098.001 t1098.003 t1213 t1213.003 github sigma
validate the deletion activity is permitted. the \"actor\" field need to be validated.	t1213 t1213.003 github sigma
validate the multifactor authentication changes.	t1098 t1098.001 t1098.003 t1213 t1213.003 github sigma
various business process or userland applications and behavior.	T1036.008 t1204.002 endpoint splunk
vendors will often copy system exectables to a different path for application usage.	t1036 t1036.005 t1218.011 endpoint splunk
verify if the modification or deletion was performed by an authorized administrator.	t1020 aws sigma
verify the user identity, user agent, and source ip address to ensure they are expected.	t1078 aws sigma
verify whether the user identity should be using the `createstack` or `createstackset` apis. if known behavior is causing false positives, it can be exempted from the rule. the \"history_window_start\" value can be modified to reflect the expected frequency of known activity within a particular environment.	aws elastic
verify whether the user identity should be using the sts `getcalleridentity` api operation. if known behavior is causing false positives, it can be exempted from the rule.	t1087 aws elastic
verify whether the user identity, user agent, and/or hostname should be making changes in your environment. log group deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1485 t1562 aws elastic
verify whether the user identity, user agent, and/or hostname should be requesting changes in your environment. password reset attempts from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1078 aws elastic
verify whether the user identity, user agent, and/or hostname should be using getsecretstring or batchgetsecretvalue apis for the specified secretid. if known behavior is causing false positives, it can be exempted from the rule.	t1555 aws elastic
very common in environments that rely heavily on macro documents	t1566 t1566.001 windows sigma
very few legitimate content-type fields will have a length greater than 100 characters.	web server splunk
very likely, including launching cmd.exe via run as administrator	t1202 windows sigma
very possible	t1564 t1564.004 windows sigma
very special / sneaky powershell scripts	t1059 t1059.001 windows sigma
very unlikely	t1003 t1003.001 windows sigma
viberpc updater calls this binary with the following commandline \"ie4uinit.exe -cleariconcache\"	t1218 windows sigma
virtual network being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
virtual network device being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
virtual network device modification or deletion may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. virtual network device modification or deletion by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure elastic
virtual network device modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
virtual network modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
virtual private cloud networks may be deleted by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 gcp elastic
virtual private cloud routes may be created by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 gcp elastic
virtual private cloud routes may be deleted by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1562 gcp elastic
vm exports may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. vm exports from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1005 t1537 aws elastic
vnc connections may be made directly to linux cloud server instances but such connections are usually made only by engineers. vnc is less common than ssh or rdp but may be required by some work flows such as remote access and support for specialized software products or servers. such work-flows are usually known and not unexpected. usage that is unfamiliar to server or network owners can be unexpected and suspicious.	t1219 network elastic
vnc connections may be received directly to linux cloud server instances but such connections are usually made only by engineers. vnc is less common than ssh or rdp but may be required by some work-flows such as remote access and support for specialized software products or servers. such work-flows are usually known and not unexpected. usage that is unfamiliar to server or network owners can be unexpected and suspicious.	t1190 t1219 network elastic
vpn connection being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	azure sigma
vpn connection modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	azure sigma
vpn tunnel being modified or deleted may be performed by a system administrator.	gcp sigma
vpn tunnel modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	gcp sigma
vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. they may be used by administrators to legitimately delete old backup copies, although this is typically rare.	t1490 endpoint splunk
vulnerability scanners	t1078 t1078.004 t1110 t1190 t1505 t1505.001 azure sigma
vulnerability scanners or system administration tools may also trigger this detection. filter as needed.	t1003.002 t1021.002 t1087 t1110 T1110.004 t1135 endpoint splunk
vulnerability scanners, print servers, and applications that deal with non-domain joined authentications. recommend adjusting the upperbound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.	t1110 T1110.003 endpoint splunk
waf rules or rule groups may be deleted by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. rule deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1562 aws elastic
we have tested this detection logic with ~2 million 4769 events and did not identify false positives. however, they may be possible in certain environments. filter as needed.	t1078 t1078.002 endpoint splunk
we recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.	t1078 t1090 t1098 t1110 t1528 t1606 azure sigma
web activity that is uncommon, like security scans, may trigger this alert and may need to be excluded. a new or rarely used program that calls web services may trigger this alert.	t1071 ml elastic
web activity that occurs rarely in small quantities can trigger this alert. possible examples are browsing technical support or vendor urls that are used very sparsely. a user who visits a new and unique web destination may trigger this alert when the activity is sparse. web applications that generate urls unique to a transaction may trigger this when they are used sparsely. web domains can be excluded in cases such as these.	t1071 ml elastic
web applications that invoke linux command line tools	t1505 t1505.003 linux sigma
web applications that use the same url parameters as regeorg	t1505 t1505.003 sigma
web browsers and third party application might generate similar activity. an initial baseline is required.	t1550 t1550.003 t1558 t1558.003 windows sigma
web sites like wikis with articles on os commands and pages that include the os commands in the urls	t1505 t1505.003 sigma
websense endpoint using the pipe name \"dsernamepipe(r\|w)\d{1,5}\"	t1055 windows sigma
weird admins that rename their tools	t1202 t1587 t1587.001 windows sigma
werfault.exe will legitimately spawn when dns.exe crashes, but the dns service is very stable and so this is a low occurring event. denial of service (dos) attempts by intentionally crashing the service will also cause werfault.exe to spawn.	t1210 windows elastic
when a gpo is manually edited and 5136 events are not logging to splunk.	t1222 t1222.001 t1484 t1484.001 endpoint splunk
when a legitimate new user logins for the first time, this activity will be detected. check how old the account is and verify that the user activity is legitimate.	t1078.004 T1535 t1552 t1586 t1586.003 aws instance splunk
when a new application owner is added by an administrator	t1552 azure sigma
when an admin begins using the admin console and one of okta's heuristics incorrectly identifies the behavior as being unusual.	t1078 t1078.004 okta sigma
when an admin creates a new, authorised identity provider.	t1098 t1098.001 okta sigma
when and administrator is making legitimate appid uri configuration changes to an application. this should be a planned event.	t1078 t1078.004 t1552 azure sigma
when and administrator is making legitimate uri configuration changes to an application. this should be a planned event.	t1078 t1078.004 t1528 azure sigma
when cmd.exe and xcopy.exe are called directly	t1036 t1036.003 windows sigma
when credentials are added/removed as part of the normal working hours/workflows	t1098 t1098.001 azure sigma
when executed with the \"-s\" flag. paexec will copy itself to the \"c:\windows\\" directory with a different name. usually like this \"paexec-[xxxxx]-[computername]\"	t1202 windows sigma
when remote authentication is in place, this should not change often	t1098 t1136 t1136.001 cisco sigma
when the command contains the keywords but not in the correct order	t1036 t1036.003 windows sigma
when the permission is legitimately needed for the app	t1098 t1098.003 t1528 azure sigma
when there is a change to ntsecuritydescriptor, windows logs the entire acl with the newly added components. if existing accounts are present with this permission, they will raise an alert each time the ntsecuritydescriptor is updated unless whitelisted.	t1484 endpoint splunk
when your development is spreaded in different time zones, applying this rule can be difficult.	t1204 T1204.003 aws account splunk
whenever someone receives an rdp file as an email attachment and decides to save or open it right from the attachments	windows sigma
while infrequent, the applicationimpersonation role may be granted for leigimate reasons, filter as needed.	t1098 T1098.002 o365 tenant splunk
while it is possible for legitimate scripts or administrators to trigger this behavior, filtering can be applied based on the parent process and application to reduce false positives. analysts should reference the provided references to understand the context and threat landscape associated with this activity.	t1053 t1053.005 endpoint splunk
while it is possible to have false positives, due to legitimate administrative tasks, these are usually limited and should still be validated and investigated as appropriate.	t1053 t1053.005 endpoint splunk
while legitimate, these nirsoft tools are prone to abuse. you should verfiy that the tool was used for a legitimate purpose.	t1072 endpoint splunk
while not common, administrators may enable accounts and reset their passwords for legitimate reasons. filter as needed.	t1098 azure active directory splunk
while sometimes 'process hacker is used by legitimate administrators, the execution of process hacker must be investigated and allowed on a case by case basis	t1543 t1564 t1622 windows sigma
while the file extensions in question can be suspicious at times. it's best to add filters according to your environment to avoid large amount false positives	t1197 windows sigma
while there are legitimate scenarios for these permissions, such as an executive assistant needing access to an executive's mailbox, there are also malicious scenarios. investigate and filter as needed.	t1098 T1098.002 t1114 T1114.002 o365 tenant splunk
while this can be normal behavior, it should be investigated to ensure validity. verify whether the user identity should be using the iam `attachrolepolicy` api operation to attach the `administratoraccess` policy to the target role.	t1098 aws elastic
while this search has no known false positives, it is possible that a gcp admin has legitimately created a public bucket for a specific purpose. that said, gcp strongly advises against granting full control to the \"allusers\" group.	T1530 gcp storage bucket splunk
while this search has no known false positives, it is possible that an aws admin has legitimately created keys for another user.	t1078 t1136 t1136.003 aws account splunk
while this search has no known false positives, it is possible that it is a legitimate admin activity. please consider filtering out these noisy events using useragent, user_arn field names.	t1485 T1485.001 t1562 T1562.008 aws account splunk
while this search has no known false positives.	t1526 aws account splunk
will be used sometimes by admins to clean up local flash space	t1070 t1070.004 t1561 t1561.001 t1561.002 cisco sigma
will depending on accuracy of dlp rules, these can be noisy so tune appropriately.	t1048 t1567 o365 tenant splunk
windows administrator tasks or troubleshooting	t1047 t1053 t1053.002 t1547 t1547.004 t1569 t1569.002 zeek sigma
windows can used this application for its normal com object validation.	t1218 T1218.012 endpoint splunk
windows defender atp	t1027 t1059 t1059.001 windows sigma
windows defender av updates may trigger this alert. please adjust the filter macros to mitigate false positives.	t1485 endpoint splunk
windows domains with dfl 2003 and legacy systems	t1558 t1558.003 windows sigma
windows error reporting might produce similar behavior. in that case, check the pid associated with the \"-p\" parameter in the commandline.	t1003 t1003.001 windows sigma
windows firewall can be disabled by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. windows profile being disabled by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1059 t1562 windows elastic
windows installed on non-c drive	t1574 t1574.002 windows sigma
windows management scripts or software	t1047 t1053 t1053.002 t1547 t1547.004 t1569 t1569.002 zeek sigma
windows office document may contain legitimate url link other than ms office domain. filter is needed	t1566 t1566.001 endpoint splunk
windows os or software may stop and restart services due to some critical update.	t1489 endpoint splunk
windows service update may cause this event. in that scenario, filtering is needed.	t1562 t1562.001 endpoint splunk
windowsapps installing updates via the quiet flag	t1218 t1218.007 windows sigma
windowsapps located in \"c:\program files\windowsapps\\"	t1548 t1548.002 windows sigma
winrm	t1047 t1059 t1059.001 windows sigma
winrm is a dual-use protocol that can be used for benign or malicious activity. it's important to baseline your environment to determine the amount of noise to expect from this tool.	t1021 windows elastic
wmic.exe fp depend on scripts and administrative methods used in the monitored environment.	t1220 windows sigma
wsl (windows sub system for linux)	t1021 t1021.001 windows sigma
wsl2 network bridge powershell script used for wsl/kubernetes/docker (e.g. https://github.com/microsoft/wsl/issues/4150#issuecomment-504209723)	t1090 windows sigma
you may have to tune certain domains out that excel may call out to, such as microsoft or other business use case domains.	t1203 windows sigma
you will encounter noise from legitimate print-monitor registry entries.	t1547 t1547.010 endpoint splunk