EVTX-to-MITRE-Attack

KO | EN

gitlite — search

#python #typescript #go #golang #android #deep-learning #docker #nodejs #windows #awesome-list #security #ios #mcp #open-source

EVTX-to-MITRE-Attack

(★ 641)

Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

File Explorer

Download Latest Version (.zip)

- ID1116-1117-Defender threat detected.evtx
- ID1151-Defender health status.evtx
- ID11,13,17,18-PSexec as system execution.evtx
- ID4624,4688,5140,5145-Eternal Romance - MS17_010_psexec (GLOBAL).evtx
- ID4674,5142-Mimikatz print spool privileges requested.evtx
- ID4674,6416 New external device connected (PrintNightmare).evtx
- ID4688,4698,4699,5145,4624-ATexec remote trask creation (GLOBAL).evtx
- ID4688,5140,5145-WMIexec execution via SMB (GLOBAL).evtx
- ID4720,4698-Fortinet APT group abuse on Windows.evtx
- ID4742,4935,4662,4661,5137-DCshadow attack (GLOBAL) failed.evtx
- ID47x,4661-4662,5136,4688,4697-SAM the admin (CVE-2021-42287).evtx
- ID5140-5145,4688,4697-Encrypted payload deployed with service over SMB (GLOBAL).evtx
- ID5145-4624-DonPAPI full extraction.evtx
- - ID1149-RDP success logins to multiple hosts.evtx
  - ID33205-SQL Server failed login with disabled SA account.evtx
  - ID4625-failed login with denied access due to account restriction.evtx
- - ID1-WMI spwaning PowerShell process - WMImplant.evtx
  - ID1-WMIexec process execution.evtx
  - ID3-7-10-Suspicious DLL loaded (CME+Mimikatz).evtx
  - ID4688-5145-WMIexec execution via SMB.evtx
- - ID4688-4698 Persistent scheduled task with SYSTEM privileges creation.evtx
  - ID4688-Interactive shell using AT schedule task.evtx
  - ID4688-Scheduled task creation.evtx
  - ID4698-4699-Fast created & deleted task by ATexec (susp. arg.).evtx
  - ID4698-4699-Fast created & deleted task by SMBexec (sups. arg.).evtx
  - ID5145-Remote schedule task creation (ATexec).evtx
- - ID4103-4104-Payload download via PowerShell.evtx
  - ID4688-Encoded PowerShell MSF payload via process execution.evtx
  - ID800-4103-Interactive PipeShell over named pipe (server and client).evtx
- - ID4688-SQL Server payload injectection for reverse shell (MSF).evtx
- - ID4688-Edge payload download via command.evtx
- - ID5145-remote service creation over SMB.evtx
  - ID5145-service massive remote creation via named pipe - Tchopper.evtx
  - ID7000,7009,7045-Payload deployed via service - Tchopper.evtx
  - ID7009-Service deployment time out (meterpreter).evtx
- - ID33205-SQL Server member added to database role.evtx
  - ID33205-SQL Server member added to server role.evtx
  - ID33205-SQL Server user linked to a database.evtx
  - ID4688-SPN added to an account.evtx
  - ID4723-5145-password reset with changeNTLM (Mimikatz).evtx
  - ID4724-5145-password reset with setNTLM (Mimikatz).evtx
  - ID4728-4756-Member added to sensitive domain groups.evtx
  - ID4728-Massive account group membership change.evtx
  - ID4728-Member adding to a group by the same account.evtx
  - ID4732-4733-Quick added-removed user from local group.evtx
  - ID4732-DNSadmin new member added.evtx
  - ID4732-User added to local admin groups.evtx
  - ID4738,5136-SPN set on user account.evtx
  - ID4738-Account is sensitive and cannot be delegated.evtx
  - ID4738-Account with password not required.evtx
  - ID4738-Do not require Kerberos preauthentication.evtx
  - ID4738-Password cannot be changed.evtx
  - ID4738-Password never expires.evtx
  - ID4738-Use only Kerberos DES encryption types.evtx
  - ID4738-User set with reversible psw encryption.evtx
  - ID4742,5136-Enable Trust this computer for delegation (to any service, Kerberos only).evtx
  - ID4742,5136-Enable Trust this computer for delegation (to specified service, any protocol).evtx
  - ID4742,5136-Enable Trust this computer for delegation (to specified service, Kerberos only).evtx
  - ID4742,5136-SPN set on computer account.evtx
  - ID4742-SPN set on computer account (DCshadow).evtx
  - ID4756-Exchange admin group change.evtx
  - ID4781-4738-User renamed to admin or likely.evtx
  - ID4781-Computer account renamed without a trailing $ (CVE-2021-42278).evtx
  - ID5136-4662 AD object owner changed.evtx
  - ID5136-Computer account set for RBCD delegation.evtx
- - ID33205-SQL Server Disabled SA user activated.evtx
  - ID33205-SQL Server local user created.evtx
  - ID4688-User creation via commandline.evtx
  - ID472, 4728 Hidden user creation.evtx
  - ID4720-4726 Fast created-deleted user.evtx
  - ID4720-Admin like user created.evtx
  - ID4720-Fake computer account created.evtx
  - ID4720-Local user created.evtx
  - ID4722-Guest account activated.evtx
  - ID4741-Computer account created with privileges.evtx
  - ID4742-4743-Fast created & deleted computer account.evtx
- - ID3-59-60-BITS job created.evtx
  - ID4688-BITS transfer initiated.evtx
  - ID60-High volume file downloaded with BITS.evtx
  - ID800-4103-4104-PowerShell BITS job started.evtx
- - ID11-Exchange transport config modified.evtx
  - ID6-Failed to install an Exchange transport agent.evtx
- - ID11715-SQL Server started in single mode for psw recovery.evtx
  - ID15457-SQL server CLR lateral movement.evtx
  - ID15457-SQL Server CMDshell enabled.evtx
  - ID4688-SQL Server started in single mode for psw recovery.evtx
  - ID4688-sqlcmd tool abuse in SQL Server.evtx
- - ID13-New service for Mimikatz.evtx
  - ID4688-4697 RDP hijack via service creation.evtx
  - ID4688-Command SC to create service on remote host.evtx
  - ID4688-Service abuse with Failure Command.evtx
  - ID4688-Service abuse with malicious path.evtx
  - ID4688-Service created (command).evtx
  - ID4688-Service permissions modified (registry).evtx
  - ID4688-Service permissions modified (sc).evtx
  - ID4697-MSF payload deployed via service.evtx
  - ID4697-New service for Mimikatz.evtx
  - ID7045-4697-SMBexec service registration.evtx
  - ID7045-7036 PSexec service installation.evtx
  - ID7045-New service for Mimikatz +npcap.evtx
  - ID7045-Random service installation.evtx
  - ID800-4103-4104-Service abuse with Failure Command.evtx
  - ID800-4103-4104-Service abuse with malicious path.evtx
  - ID800-4103-4104-Service creation (PowerShell).evtx
- - ID13-WMIimplant registry crash control.evtx
  - ID19-20-WMI registration via PowerLurk.evtx
  - ID4688-netsh helper DLL.evtx
  - ID5136-AdminSDholder backdoor obfuscation (via localizationDisplayId).evtx
  - ID5136-AdminSDholder permissions changed.evtx
  - ID800-4103-4104-WMI registration via PowerLurk.evtx
- - ID12-LSA Protect mode enabled RunAsPPL.evtx
  - ID4622-New SSP loaded in LSA (only legitim).evtx
  - ID4664-symbolic link created.evtx
- - ID150-Failed DLL loaded by DNS server.evtx
  - ID4688-DNS DLL serverlevelplugindll command.evtx
  - ID770-Success DLL loaded by DNS server.evtx
  - ID800-4103-4104-Print spooler privilege escalation (CVE-2020-1048).evtx
- - ID12-13 Mini_Plasma_PoC_AbortHydration_ArbitraryRegKey_EoP.evtx
  - ID4673-Privilege SeMachineAccountPrivilege called.evtx
- - ID4648-4624-RunAsCS login.evtx
  - ID4688,4624-RottenPotatoNG.evtx
  - ID4688,4648,4624-Runas execution with different user.evtx
  - ID4704-4705-User righ assigned to account.evtx
  - ID4717-4718-System security granded to account.evtx
- - ID 4765 - SID history added.evtx
- - ID 4865 4706 - trust added.evtx
- - ID5136-4662 sensitive GPO edited.evtx
- - ID1-CMD executed via sticky key call.evtx
  - ID11-New sethc file created from CMD copy.evtx
  - ID12,13-Stickey key registry update.evtx
  - ID4656-Failed sethc replacement by CMD.evtx
  - ID4688-Stickey command reg update + execution.evtx
- - 1-Print spool spawned a CMD shell (PrintNightMare).evtx
  - ID316,300,301,316,823,848-Mimispool printer server instal.evtx
  - ID354-808-Mimispool printer installation (PrintNightmare).evtx
  - ID4688,6416,4648-SystemNightMare.evtx
  - International_Payments_Pricing_Sheet_072022.pdf
- - 4624,4674,4688- CrackMap Exec SMB mimikatz.evtx
  - ID1-CrackMapExec payload execution.evtx
  - ID400-800-CrackMapExec payload execution.evtx
  - ID4103-4104-CrackMapExec payload execution.evtx
  - ID4688-Obfuscated payload transfer via service name - Tchopper.evtx
- - ID104-1102-Event log cleared.evtx
  - ID4688-Clear event log attempt (native).evtx
  - ID4688-Clear event log attempt (wmi).evtx
  - ID800-4103-4104-Clear event log attempt.evtx
- - ID4616-system time changed.evtx
- - ID4964-Login of a member of a special group.evtx
- - ID11,13-SMBexec service registration.evtx
  - ID4624,4670,4688,4674-Registry permission change via WMI (DAMP).evtx
  - ID800-4103-4104-Registry permission change via WMI (DAMP) PowerShell on source.evtx
- - ID4688-Certutil download.evtx
- - ID9-WSL module installation (KBC).evtx
- - ID4662-Sensitive attributes accessed (DCshadow).evtx
  - ID5137-Fake domain controller registration (DCshadow).evtx
- - ID5124-OCSP security settings changed.evtx
  - ID5136-Permission change on OU by computer.evtx
  - ID5136-Permission change on OU by user.evtx
  - ID5136-Permission change on top root AD (DCsync).evtx
  - ID5136-Permissions changed on a GPO.evtx
  - ID5143-File share permissions changed.evtx
- - ID12-13 SIP provider registration.evtx
- - ID 5376, 5379, 5382, 5381, 5382 credential manager and vault.evtx
- - ID1-SYSMON driver unload (FilterManager).evtx
  - ID13-Defender service configuration disabled.evtx
  - ID4688-Defender critical features disabled (command).evtx
  - ID4688-Defender service deactivation attempt.evtx
  - ID5007-Defender threat exclusion (native).evtx
  - ID8-Module Virtualization disabled (Credential Guard).evtx
  - ID800-4103-4104 Defender critical features disabled (PowerShell).evtx
  - ID800-4103-4104 Defender default action allow any (PowerShell).evtx
  - ID800-4103-4104 Defender exclusion added (PowerShell).evtx
- - ID33205-SQL Server audit object disabled.evtx
  - ID33205-SQL Server audit object deleted.evtx
  - ID33205-SQL Server audit specification deleted.evtx
  - ID33205-SQL Server audit specification disabled.evtx
  - ID33205-SQL Server Database audit specification deleted.evtx
  - ID33205-SQL Server Database audit specification disabled.evtx
  - ID4688-Audit policy clear attempt.evtx
  - ID4688-Audit policy deactivation attempt.evtx
  - ID4719-Audit policy deactivation.evtx
  - ID4739-Domain policy changed by non system account.evtx
  - ID4885,4876,4877,5123,5124-ADCS PKI OCSP.evtx
  - ID4908-Special group table changed.evtx
  - ID541-DNS server auditing changed.evtx
- - ID2003-4950-Firewall disabled.evtx
  - ID2004-Any any firewall rule created.evtx
  - ID2004-New firewall rule created by PowerShell.evtx
  - ID4103-4104-2004-OpenSSH firewall rule activation.evtx
  - ID4688-5447-4950-Firewall disabled (command).evtx
  - ID800-4103-Firewall disabled.evtx
- - ID4688-Linux Subsystem installation (WSL).evtx
- - ID1-12-13-Wdigest authentication activation.evtx
  - ID1-LSASS dump with LSASSY (SYSMON).evtx
  - ID10-Mimikatz LSASS process dump.evtx
  - ID11-LSASS credentials dump via Task Manager.evtx
  - ID11-Mimikatz LSA SSP clear text password exfiltration.evtx
  - ID325-327-IFM created - ESENT.evtx
  - ID4656, 5145, 4674-Impacket secret dump via SMB.evtx
  - ID4656-4663-4658 Mimikatz sekurlsa password dump.evtx
  - ID4661-4658 Mimikatz sekurlsa password dump SAM.evtx
  - ID4661-Suspicious SAM access to password attributes by LSASS (Dcshadow).evtx
  - ID4662-DCsync attack using Mimikatz.evtx
  - ID4663-Task Manager used to dump LSASS process.evtx
  - ID4688-4663-4656-LSASS dump with LSASSY (process).evtx
  - ID4688-Diskshadow abuse.evtx
  - ID4688-IFM created.evtx
  - ID4688-Task Manager access indicator for potential LSASS dump.evtx
  - ID4756-Exchange critical group change (DCsync).evtx
  - ID4794-4688-DSRM password set with NTDSutil.evtx
  - ID800-4103-4104-LSASS dump with LSASSY (PowerShell).evtx
- - ID-4688 Native Windows sniffer Pktmon usage.evtx
- - ID 4776,4625-AccountRestore local bruteforce.evtx
  - ID18456-SQL Server failed login because only Windows auth.evtx
  - ID33205-SQL Server failed login because only Windows auth.evtx
  - ID33205-SQL Server failed login with non existing accounts.evtx
  - ID33205-SQL Server failed login with SA wrong password.evtx
  - ID4-OpenSSH brutforce with non existing users (sshd logs).evtx
  - ID4-OpenSSH brutforce with valid users.evtx
  - ID4625-OpenSSH brutforce with non existing users.evtx
  - ID4625-OpenSSH brutforce with valid users.evtx
  - ID4768-4771-Kerberos brutforce with non existing users.evtx
  - ID4768-4771-Kerberos user enumeration (Kerbrute).evtx
  - ID4771-Kerberos brutforce with valid user.evtx
- - ID70-CAPI-Private key accessed Mimikatz.evtx
- - ID4662-Sensitve DPAPI attributes accessed.evtx
  - ID5145-user file-credentials-browser dump via network share.evtx
- - ID5145-Print spooler bug abuse.evtx
  - ID515-DNS entry created with wildcard.evtx
- - ID4624-Success login with Golden ticket.evtx
  - ID4768-4769-Kerberos host ticket without a trailing $.evtx
  - ID4768-Kerberos AS-REP Roasting.evtx
  - ID4769-Golden ticket issued.evtx
  - ID4769-Kerberoast ticket with low encryption.evtx
- - ID 39 KDC - ADCS ESC 1 auth request.evtx
  - ID 4882 - ADCS ESC 7.evtx
  - ID 4886-4887 - ADCS ESC 1.evtx
  - ID 4886-4887 - ADCS ESC 2.evtx
  - ID 4886-4887 - ADCS ESC 3.evtx
- - ID4688-Audit policy enumerated.evtx
  - ID4688-Firewall configuration enumerated (command).evtx
  - ID4688-Scheduled task configuration enumeration.evtx
  - ID6004-DNS-server-failed zone transfer.evtx
  - ID800-4103-4104-Firewall configuration enumerated (PowerShell).evtx
- - ID5145-DNS hosts files access via network share.evtx
- - ID131-RDP brutforce (no user info).evtx
  - ID4624-Anonymous login with domain specified (DonPapi).evtx
- - ID4661-Local group enumeration with RID brutforce with CME.evtx
  - ID4661-SAM sensitive domain users & groups discovery.evtx
  - ID4662-Domain group enumeration CME.evtx
  - ID4688-Group discovery via commandline.evtx
  - ID4799-4624-Local admin group enumerated by SharpHound.evtx
  - ID800-4103-4104-Domain group discovery via PowerShell.evtx
  - ID800-4103-4104-Local group discovery via PowerShell.evtx.evtx
- - ID1-SPN discovery (SYSMON process).evtx
  - ID4103-4104 - SPN discovery (moder nPowerShell).evtx
  - ID4662-4624-Honeypot account property read.evtx
  - ID4688-List all Service Principal Names (SPN).evtx
  - ID4688-User enumeration via command.evtx
  - ID4769-Kerberos TGS host enumeration (Bloodhound).evtx
  - ID600-Active Directory module called by PowerShell.evtx
  - ID800 - SPN discovery (PowerShell).evtx
- - ID4688-Network share discovery or connection via commandline.evtx
  - ID5140-5145-Bloodhound-SharpHound enumeration via SMB.evtx
  - ID5140-Failed ADMIN$ share access.evtx
- - ID4661-Password policy enumeration.evtx
  - ID4688-Password policy discovery via commandline.evtx
- - ID800,4103,4104-Active Directory Forest PowerShell class.evtx
- - ID4688,4778,4779 RDP hijack direct.evtx
  - ID4688-4778 RDP hijack command execution.evtx
  - ID4825-Denied RDP connection with valid credentials.evtx
- - ID4688,4697,5140-5145 PSexec remote execution + admin share.evtx
  - ID4688-4648 Lateral movement with net use.evtx
  - ID4688-Network share manipulation via commandline.evtx
  - ID5140-ADMIN$ share connection with Golden ticket.evtx
  - ID5142- New file share created.evtx
  - ID5142-5143-Mimispool print share created and modified.evtx
  - ID5145-remote shell execution via SMB admin share.evtx
- - ID4103,4104-DCOMexec native via PowerShell.evtx
  - ID4688,4674-DCOMexec process spawned.evtx
- - ID4-OpenSSH server listening.evtx
  - ID4103-4104-OpenSSH server activation and config.evtx
  - ID4103-4104-OpenSSH server install.evtx
- - ID4656-WS Management listener enumeration.evtx
- - ID4624-Mimikatz Pass the hash.evtx
- WSUS Remote Code Execution (CVE-2025-59287 filtered.evtx
- - ID13-RDP shadow session configuration enabled (registry).evtx
- - ID5600-proxy configuration changed.evtx
- - ID4688-netsh RDP port forwarding abuse.evtx
- - ID 768,775,793,796,817,840-BitLocker encryption activated.evtx
- - ID4688-Delete VSS backup (WMI).evtx
  - ID4688-Delete Window backup (webadmin).evtx
  - ID800-4103-4104-Delete VSS backup (PowerShell).evtx
- - ID11-DNS hosts files modified.evtx
.gitignore
LICENSE.md
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# EVTX to MITRE ATT@CK

## Project purpose
**EVTX to MITRE ATT@CK** is a *Security Information Management System* orientated project. It provides >270 Windows IOCs indicators classified per Tactic and Technique in order to address different security scenarios with your SIEM:
* Measure your security coverage
* Enhance your detection capacities
* Identify security gaps or uncovered threats
* Design new use cases

## How to use the IOCs
IOCs are provided in the EVTX format, the standard format established by Microsoft starting Windows Server 2008 and Windows Vista for event logs. Depending on the SIEM solution you utilize, you may need to make your agent (NXLog, Winlogbeat, Splunk UF, ArcSight, WinCollect, Snare, ...) pointing to the EVTX files and send the content to your SIEM in the adequate format.

## Microsoft log sources used:
* Windows 10
* Windows Server 2012 R2 and higher
* Active Directory Domain Services (ADDS)
* Active Directory Certification Services (ADCS / PKI) with online responder (OCSP)
* SQL Server 2014
* Windows Defender
* SYSMON v11 and higher
* Exchange 2016
* Internet Information Services (IIS web server) -- *planned*

## Related and/or connected projects:
If you are interesting in external projects arround SIGMA and EVTX analysis, I would like to suggest the following ones:
* **EVTX-ATTACK** from @sbousseaden: https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
* **OTRF/Security-Datasets (from Mordor project)**: https://github.com/OTRF/Security-Datasets/tree/master/datasets/atomic/windows
* **Atomic RedTeam**: https://github.com/redcanaryco/atomic-red-team
* Export EVTX to Elastic with Winlogbeat: https://medium.com/@duzvik/import-evtx-collections-in-to-elastic-989b7f49b4b8
* **EvtxToElk**: https://www.dragos.com/blog/industry-news/evtxtoelk-a-python-module-to-load-windows-event-logs-into-elasticsearch/
* **Zircolite** (SIGMA detection for EVTX): https://github.com/wagga40/Zircolite

## IOCs content

ATT@CK Tactic	| ATT@CK  Technique	| Description | 	Event IDs   |			Threat name / Tool / CVE
|:-------------------------|:------------------|:-------------------------|:------------------|:------------------|
Antivirus | Antivirus | Defender: antivirus not up to date | 1151 | 
Antivirus | Antivirus | Defender: massive malware outbreak detected on multiple hosts | 1116 | 
Antivirus | Antivirus | Defender: massive malwares detected on a single host | 1116 | 
TA0001-Initial access | T1078.002-Valid accounts-Domain accounts | Login denied due to account policy restrictions | 4625 | 
TA0001-Initial access | T1078.002-Valid accounts-Domain accounts | Login failure from a single source with a disabled account | 33205 | 
TA0001-Initial access | T1078.002-Valid accounts-Domain accounts | Success login on OpenSSH server | 4 | SSH server
TA0001-Initial access | T1078.002-Valid accounts-Domain accounts | Success login on OpenSSH server | 4624 | SSH server
TA0001-Initial access | T1078-Valid accounts | RDP reconnaissance with valid credentials performed to multiple hosts | 4624 or 1149 | 
TA0002-Execution | T1047-Windows Management Instrumentation | Impacket WMIexec process execution | 1 or 4688 | WMIexec
TA0002-Execution | T1053.005-Scheduled Task | Interactive shell triggered by scheduled task (at, deprecated) | 1 or 4688 | 
TA0002-Execution | T1053.005-Scheduled Task | Persistent scheduled task with SYSTEM privileges creation | 1 or 4688 | 
TA0002-Execution | T1053.005-Scheduled Task | Remote schedule task creation via named pipes | 5145 | Atexec
TA0002-Execution | T1053.005-Scheduled Task | Schedule task created with suspicious arguments | 4698 | Atexec
TA0002-Execution | T1053.005-Scheduled Task | Schedule task fastly created and deleted | 4698 and 4699 | Atexec
TA0002-Execution | T1053.005-Scheduled Task | Scheduled task creation | 1 or 4688 | 
TA0002-Execution | T1059.001-Command and Scripting Interpreter: PowerShell | Encoded PowerShell payload deployed | 800 or 4103 or 4104 | 
TA0002-Execution | T1059.001-Command and Scripting Interpreter: PowerShell | Interactive PipeShell over SMB named pipe | 800 or 4103 or 4104 | 
TA0002-Execution | T1059.001-Command and Scripting Interpreter: PowerShell | Payload downloaded via PowerShell | 800 or 4103 or 4104 | 
TA0002-Execution | T1059.003-Windows Command Shell | Encoded PowerShell payload deployed via process execution | 1 or 4688 | 
TA0002-Execution | T1059.003-Windows Command Shell | SQL Server payload injectection for reverse shell (MSF) | 1 or 4688 | 
TA0002-Execution | T1204-User execution | Edge abuse for payload download via console | 1 or 4688 | 
TA0002-Execution | T1204-User execution | Edge/Chrome headless feature abuse for payload download | 1 or 4688 | 
TA0002-Execution | T1569.002-Service Execution | PSexec installation detected | 1 or 4688 | 
TA0002-Execution | T1569.002-Service Execution | Service massive failures (native) | 7000 or 7009 | Tchopper
TA0002-Execution | T1569.002-Service Execution | Service massive installation (native) | 7045 or 4697 | Tchopper
TA0002-Execution | T1569.002-Service Execution | Service massive remote creation via named pipes (native) | 5145 | Tchopper
TA0003-Persistence | T1078.002-Valid accounts-Domain accounts | Account renamed to "admin" (or likely) | 4781 | 
TA0003-Persistence | T1098.xxx-Account manipulation | Computer account created with privileges | 4741 | CVE-2021-42278/42287 & SAM-the-admin
TA0003-Persistence | T1098.xxx-Account manipulation | Computer account renamed without a trailing $ | 4781 | CVE-2021-42278/42287 & SAM-the-admin
TA0003-Persistence | T1098.xxx-Account Manipulation | High risk domain group membership change | 4728 or 4756 | 
TA0003-Persistence | T1098.xxx-Account manipulation | High risk Exchange group membership change | 4728 or 4756 or 4732 | 
TA0003-Persistence | T1098.xxx-Account Manipulation | High risk local-domain local group membership change | 4732 | 
TA0003-Persistence | T1098.xxx-Account manipulation | High risk Skype/Lync/OCS group membership change | 4728 or 4756 or 4732 | 
TA0003-Persistence | T1098.xxx-Account manipulation | Host delegation settings changed for potential abuse (any protocol) | 4742 | Rubeus
TA0003-Persistence | T1098.xxx-Account manipulation | Host delegation settings changed for potential abuse (any service, Kerberos only) | 4742 | Rubeus
TA0003-Persistence | T1098.xxx-Account manipulation | Host delegation settings changed for potential abuse (Kerberos only) | 4742 | Rubeus
TA0003-Persistence | T1098.xxx-Account manipulation | Low risk Skype/Lync/OCS group membership change | 4728 or 4756 or 4732 | 
TA0003-Persistence | T1098.xxx-Account manipulation | Medium risk Exchange group membership change | 4728 or 4756 or 4732 | 
TA0003-Persistence | T1098.xxx-Account Manipulation | Medium risk local-domain local group membership change | 4732 | 
TA0003-Persistence | T1098.xxx-Account manipulation | Medium risk Skype/Lync/OCS group membership change | 4728 or 4756 or 4732 | 
TA0003-Persistence | T1098.xxx-Account Manipulation | Member added and removed from a group by a user account in a short period of time  | 4728/29,4756/57,4732/33 | 
TA0003-Persistence | T1098.xxx-Account Manipulation | Member added to a group by the same account | 4728 or 4756 or 4732 | 
TA0003-Persistence | T1098.xxx-Account manipulation | Member added to DNSadmins group for DLL abuse | 4732 | DNS DLL abuse
TA0003-Persistence | T1098.xxx-Account manipulation | New admin (or likely) created by a non administrative account | 4720 | 
TA0003-Persistence | T1098.xxx-Account manipulation | SPN modification of a computer account (Directory Services) | 5136 | DCShadow
TA0003-Persistence | T1098.xxx-Account manipulation | SPN modification of a computer account | 4742 | 
TA0003-Persistence | T1098.xxx-Account manipulation | SPN modification of a computer account | 4742 | DCShadow
TA0003-Persistence | T1098.xxx-Account manipulation | SPN modification of a user account | 5136 | Kerberoasting
TA0003-Persistence | T1098.xxx-Account manipulation | SQL Server: new member added to a database role | 33205 | 
TA0003-Persistence | T1098.xxx-Account manipulation | SQL Server: new member added to server role | 33205 | 
TA0003-Persistence | T1098.xxx-Account manipulation | User account created and/or set with reversible encryption detected | 4738 | 
TA0003-Persistence | T1098.xxx-Account manipulation | User account marked as "sensitive and cannot be delegated" its had protection removed | 4738 | 
TA0003-Persistence | T1098.xxx-Account manipulation | User account set to not require Kerberos pre-authentication | 4738 | 
TA0003-Persistence | T1098.xxx-Account manipulation | User account set to use Kerberos DES encryption | 4738 | 
TA0003-Persistence | T1098.xxx-Account manipulation | User account with password set to never expire detected | 4738 | 
TA0003-Persistence | T1098.xxx-Account manipulation | User account with password set to not require detected | 4738 | 
TA0003-Persistence | T1098.xxx-Account manipulation | User password change using current hash password - ChangeNTLM | 4723 | Mimikatz
TA0003-Persistence | T1098.xxx-Account manipulation | User password change without previous password known - SetNTLM | 4724 | Mimikatz
TA0003-Persistence | T1098.xxx-Account Manipulation | User performing massive group membership changes on multiple differents groups | 4728 or 4756 | 
TA0003-Persistence | T1098-Account Manipulation | Computer account set for RBCD delegation | 5136 | 
TA0003-Persistence | T1098-Account Manipulation | Disabled guest or builtin account activated | 4722 | 
TA0003-Persistence | T1098-Account Manipulation | SPN added to an account (command) | 1 or 4688 | 
TA0003-Persistence | T1136.001-Create account-Local account | Hidden account creation (with fast deletion) | 4720 and 4726 | 
TA0003-Persistence | T1136.001-Create account-Local account | Local user account created on a single host | 4720 | 
TA0003-Persistence | T1136.001-Create account-Local account | SQL Server: disabled SA account enabled | 33205 | 
TA0003-Persistence | T1136.002-Create account-Domain account | Computer account created and deleted in a short period of time | 4741 and 4743 | 
TA0003-Persistence | T1136.002-Create account-Domain account | User account created and deleted in a short period of time | 4720 and 4726 | 
TA0003-Persistence | T1136.002-Create account-Domain account | User account creation disguised in a computer account | 4720 or 4781 | 
TA0003-Persistence | T1136-Create account | User creation via commandline | 1 or 4688 | 
TA0003-Persistence | T1505.001-SQL Stored Procedures | SQL lateral movement with CLR | 15457 | 
TA0003-Persistence | T1505.001-SQL Stored Procedures | SQL Server xp_cmdshell procedure activated | 18457 | 
TA0003-Persistence | T1505.001-SQL Stored Procedures | SQL Server: sqlcmd & ossql utilities abuse | 1 or 4688 | 
TA0003-Persistence | T1505.001-SQL Stored Procedures | SQL Server: started in single mode for password recovery | 1 or 4688 | 
TA0003-Persistence | T1505.002-Server Software Component: Transport Agent | Exchange transport agent injection via configuration file | 11 | 
TA0003-Persistence | T1505.002-Server Software Component: Transport Agent | Exchange transport agent installation artifacts | 1 or 6 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Encoded PowerShell payload deployed via service installation | 7045 or 4697 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Impacket SMBexec service registration (native) | 7045 or 4697 | SMBexec
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Mimikatz service driver installation detected | 7045 or 4697 | Mimikatz
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Service abuse with backdoored "command failure" (PowerShell) | 800 or 4103 or 4104 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Service abuse with backdoored "command failure" (registry) | 1 or 4688 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Service abuse with backdoored "command failure" (service) | 1 or 4688 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Service abuse with malicious ImagePath (PowerShell) | 800 or 4103 or 4104 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Service abuse with malicious ImagePath (registry) | 1 or 4688 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Service abuse with malicious ImagePath (service) | 1 or 4688 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Service created for RDP session hijack | 7045 or 4697 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Service creation (command) | 1 or 4688 | 
TA0003-Persistence | T1543.003-Create or Modify System Process-Windows Service | Service creation (PowerShell) | 800 or 4103 or 4104 | 
TA0003-Persistence | T1546.003-Windows Management Instrumentation Event Subscription | System crash behavior manipulation  (registry) | 13 | WMImplant
TA0003-Persistence | T1546.003-Windows Management Instrumentation Event Subscription | WMI registration (PowerShell) | 800 or 4103 or 4104 | 
TA0003-Persistence | T1546.003-Windows Management Instrumentation Event Subscription | WMI registration | 19 or 20 or 21 | 
TA0003-Persistence | T1546.007-Netsh Helper DLL | Netsh helper DLL command abuse | 1 or 4688 | 
TA0003-Persistence | T1546.007-Netsh Helper DLL | Netsh helper DLL registry abuse | 13 | 
TA0003-Persistence | T1546-Event Triggered Execution | AdminSDHolder container permissions modified | 5136 | 
TA0003-Persistence | T1546-Event Triggered Execution | Extended rights backdoor obfuscation (via localizationDisplayId) | 5136 | 
TA0003-Persistence | T1547.008-Boot or Logon Autostart Execution: LSASS Driver | Security package (SSP) loaded into LSA (native) | 4622 | 
TA0003-Persistence | T1547.009-Boot or Logon Autostart Execution: Shortcut Modification  | NTFS hard link creation | 4664 | 
TA0003-Persistence | T1547.009-Boot or Logon Autostart Execution: Shortcut Modification  | NTFS symbolic link configuration change | 1 or 4688 | 
TA0003-Persistence | T1547.009-Boot or Logon Autostart Execution: Shortcut Modification  | NTFS symbolic link creation | 1 or 4688 | 
TA0003-Persistence | T1574.002-DLL Side-Loading | DNS DLL "serverlevelplugindll" command execution | 1 or 4688 | DNS DLL abuse
TA0003-Persistence | T1574.002-DLL Side-Loading | Failed DLL loaded by DNS server | 150 | DNS DLL abuse
TA0003-Persistence | T1574.002-DLL Side-Loading | Success DLL loaded by DNS server | 770 | DNS DLL abuse
TA0003-Persistence | T1574.010-Hijack execution flow: service file permissions weakness | Service permissions modified (registry) | 1 or 4688 | 
TA0003-Persistence | T1574.010-Hijack execution flow: service file permissions weakness | Service permissions modified (service) | 1 or 4688 | 
TA0004-Privilege Escalation | T1068-Exploitation for Privilege Escalation | Privilege SeMachineAccountPrivilege abuse | 4673 | CVE-2021-42278/42287 & SAM-the-admin
TA0004-Privilege Escalation | T1134.001- Access Token Manipulation: Token Impersonation/Theft | Anonymous login | 4624 and 4688 | RottenPotatoNG
TA0004-Privilege Escalation | T1134.002- Access Token Manipulation: Create Process with Token | Privilege escalation via runas (command) | 4688 and 4648 and 4624 | 
TA0004-Privilege Escalation | T1134.002- Access Token Manipulation: Create Process with Token | Privilege escalation via RunasCS | 1 or 4688 | 
TA0004-Privilege Escalation | T1134.005-Access Token Manipulation: SID-History Injection | SID history value S/F to be added to a domain account | 4765/4766/4738 | 
TA0004-Privilege Escalation | T1134-Access Token Manipulation | New access rights granted to an account by a standard user | 4717 or 4718 | 
TA0004-Privilege Escalation | T1134-Access Token Manipulation | User right granted to an account by a standard user | 4704 | 
TA0004-Privilege Escalation | T1484.001-Domain Policy Modification-Group Policy Modification | Modification of a sensitive Group Policy  | 5136 | 
TA0004-Privilege Escalation | T1484.002- Domain or Tenant Policy Modification: Trust Modification  | New external trust added | 4865, 4076 | 
TA0004-Privilege Escalation | T1543.003-Create or Modify System Process-Windows Service | PSexec service installation detected | 7045 or 4697 | 
TA0004-Privilege Escalation | T1546.008-Event Triggered Execution: Accessibility Features | CMD executed by stickey key and detected via hash | 1 or 4688 | Sticky key
TA0004-Privilege Escalation | T1546.008-Event Triggered Execution: Accessibility Features | Sticky key called CMD via command execution | 1 or 4688 | Sticky key
TA0004-Privilege Escalation | T1546.008-Event Triggered Execution: Accessibility Features | Sticky key failed sethc replacement by CMD | 4656 | Sticky key
TA0004-Privilege Escalation | T1546.008-Event Triggered Execution: Accessibility Features | Sticky key file created from CMD copy | 11 | Sticky key
TA0004-Privilege Escalation | T1546.008-Event Triggered Execution: Accessibility Features | Sticky key IFEO command for registry change | 1 or 4688 | Sticky key
TA0004-Privilege Escalation | T1546.008-Event Triggered Execution: Accessibility Features | Sticky key IFEO registry changed | 12 or 12 | Sticky key
TA0004-Privilege Escalation | T1547.010-Port Monitors | Print spooler privilege escalation via printer added | 800 or 4103 or 4104 | PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
TA0004-Privilege Escalation | T1574.002-DLL Side-Loading | External printer mapped | 4688 and 4648 | PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
TA0004-Privilege Escalation | T1574.002-DLL Side-Loading | New external device added  | 6416 | PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
TA0004-Privilege Escalation | T1574.002-DLL Side-Loading | Printer spool driver from Mimikatz installed  | 808 or 354 or 321 | PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
TA0004-Privilege Escalation | T1574.002-DLL Side-Loading | Spool process spawned a CMD shell | 1 or 4688 | PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
TA0004-Privilege Escalation | T1068-Exploitation for Privilege Escalation | MinPlasma_CVE-2020-17103  | 12 or 13 | MinPlasma_CVE-2020-17103
TA0005-Defense Evasion | T1027-Obfuscated Files or Information | Payload obfuscated transfer via service name | 1 or 4688 | Tchopper
TA0005-Defense Evasion | T1070.001-Indicator Removal on Host | Event log file(s) cleared | 104 or 1102 | 
TA0005-Defense Evasion | T1070.001-Indicator Removal on Host | Tentative of clearing event log file(s) detected (command) | 1 or 4688 | 
TA0005-Defense Evasion | T1070.001-Indicator Removal on Host | Tentative of clearing event log file(s) detected (PowerShell) | 800 or 4103 or 4104 | 
TA0005-Defense Evasion | T1070.001-Indicator Removal on Host | Tentative of clearing event log file(s) detected (wmi) | 1 or 4688 | 
TA0005-Defense Evasion | T1070.006-Timestomp | System time changed | 4616 | 
TA0005-Defense Evasion | T1078.002-Valid accounts-Domain accounts | Login from a user member of a "special group" detected (special logon) | 4964 | 
TA0005-Defense Evasion | T1112-Modify registry | Impacket SMBexec service registration (registry) | 13 | SMBexec
TA0005-Defense Evasion | T1197-BITS job | Command execution related to a suspicious BITS activity detected | 1 or 4688 | 
TA0005-Defense Evasion | T1197-BITS job | Command execution related to a suspicious BITS activity detected | 800 or 4103 or 4104 | 
TA0005-Defense Evasion | T1197-BITS job | High amount of data downloaded via BITS | 60 | 
TA0005-Defense Evasion | T1202- Indirect Command Execution  | WSL activation | 9 | 
TA0005-Defense Evasion | T1207-Rogue domain controller | New fake domain controller registration | 5137 or 5141 | DCShadow
TA0005-Defense Evasion | T1207-Rogue domain controller | Sensitive attributes accessed | 4662 | DCShadow
TA0005-Defense Evasion | T1222.001-File and Directory Permissions Modification | Computer account modifying AD permissions | 5136 | PrivExchange
TA0005-Defense Evasion | T1222.001-File and Directory Permissions Modification | Network share permissions changed | 5143 | 
TA0005-Defense Evasion | T1222.001-File and Directory Permissions Modification | OCSP security settings changed | 5124(OCSP) | 
TA0005-Defense Evasion | T1222.001-File and Directory Permissions Modification | Permissions changed on a GPO | 5136 | 
TA0005-Defense Evasion | T1222.001-File and Directory Permissions Modification | Sensitive GUID related to "Replicate directory changes" detected  | 4662 | DCSync
TA0005-Defense Evasion | T1553.003- Subvert Trust Controls: SIP and Trust Provider Hijacking  | Suspicious SIP or trust provider registration | 12 or 12 | 
TA0005-Defense Evasion | T1562.001-Impair Defenses: Disable or Modify Tools | Unload SYSMON driver | 1 | 
TA0005-Defense Evasion | T1562.001-Impair Defenses-Disable or modify tools | Defender: critical security component disabled (command) | 1 or 4688 | 
TA0005-Defense Evasion | T1562.001-Impair Defenses-Disable or modify tools | Defender: critical security component disabled (PowerShell) | 800 or 4103 or 4104 | 
TA0005-Defense Evasion | T1562.001-Impair Defenses-Disable or modify tools | Defender: default action set to allow any threat (PowerShell) | 800 or 4103 or 4104 | 
TA0005-Defense Evasion | T1562.001-Impair Defenses-Disable or modify tools | Defender: exclusion added (native) | 5007 | 
TA0005-Defense Evasion | T1562.001-Impair Defenses-Disable or modify tools | Defender: exclusion added (PowerShell) | 800 or 4103 or 4104 | 
TA0005-Defense Evasion | T1562.001-Impair Defenses-Disable or modify tools | Defender: service component status disabled (Registry via Sysmon) | 13 | 
TA0005-Defense Evasion | T1562.001-Impair Defenses-Disable or modify tools | Virtualization disabled (Credential guard) | 8 | 
TA0005-Defense Evasion | T1562.002-Disable Windows Event Logging  | OCSP auditing sttings changed | 5123(OCSP) | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  |  | 541 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | Audit policy disabled | 4719 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | Domain policy changed on one or multiple hosts | 4739 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | Membership of a special group updated | 4908 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | SQL Server: Audit object deleted | 33205 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | SQL Server: Audit object disabled | 33205 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | SQL Server: Audit specifications deleted | 33205 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | SQL Server: Audit specifications disabled | 33205 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | SQL Server: Database audit specifications deleted | 33205 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | SQL Server: Database audit specifications disabled | 33205 | 
TA0005-Defense Evasion | T1562.002-Impair Defenses: Disable Windows Event Logging  | Tentative of disabling or clearing audit policy by commandline | 1 or 4688 | 
TA0005-Defense Evasion | T1562.004-Disable or Modify System Firewall | Firewall deactivation (cmd) | 1 or 4688 | 
TA0005-Defense Evasion | T1562.004-Disable or Modify System Firewall | Firewall deactivation (firewall) | 2003 or 4950 | 
TA0005-Defense Evasion | T1562.004-Disable or Modify System Firewall | Firewall deactivation (PowerShell) | 800 or 4103 or 4104 | 
TA0005-Defense Evasion | T1562.004-Disable/modify firewall (rule) | Any/any firewall rule created | 2004 | 
TA0005-Defense Evasion | T1562.004-Disable/modify firewall (rule) | Firewall rule created by a suspicious command (netsh.exe, wmiprvse.exe) | 2004 | 
TA0005-Defense Evasion | T1562.004-Disable/modify firewall (rule) | Firewall rule created by a user account | 2004 | 
TA0005-Defense Evasion | T1562.004-Disable/modify firewall (rule) | OpenSSH server firewall configuration (command) | 1 or 4688 | SSH server
TA0005-Defense Evasion | T1562.004-Disable/modify firewall (rule) | OpenSSH server firewall configuration (firewall) | 2004 | SSH server
TA0005-Defense Evasion | T1562.004-Disable/modify firewall (rule) | OpenSSH server firewall configuration (PowerShell) | 800 or 4103 or 4104 | SSH server
TA0005-Defense Evasion | T1564.006-Hide Artifacts: Run Virtual Instance | WSL for Windows installation detected (command) | 1 or 4688 | 
TA0006-Credential Access | T1003.001-Credential dumping: LSASS | LSASS credential dump with LSASSY (kernel) | 4656 or 4663 | 
TA0006-Credential Access | T1003.001-Credential dumping: LSASS | LSASS credential dump with LSASSY (PowerShell) | 800 or 4103 or 4104 | 
TA0006-Credential Access | T1003.001-Credential dumping: LSASS | LSASS credential dump with LSASSY (process) | 1 or 4688 | 
TA0006-Credential Access | T1003.001-Credential dumping: LSASS | LSASS credential dump with LSASSY (share) | 5145 | 
TA0006-Credential Access | T1003.001-Credential dumping: LSASS | LSASS credentials dump via Task Manager (file) | 11 | 
TA0006-Credential Access | T1003.001-Credential dumping: LSASS | LSASS dump indicator via Task Manager access | 1 or 4688 | 
TA0006-Credential Access | T1003.001-Credential dumping: LSASS | LSASS process accessed by a non system account | 4656 or 4663 | 
TA0006-Credential Access | T1003.001-Credential dumping: LSASS | SAM database user credential dump | 4661 | Mimikatz
TA0006-Credential Access | T1003.001-Credential dumping: LSASS | Task manager used to dump LSASS process | 4663 | 
TA0006-Credential Access | T1003.002-Security Account Manager | Password dump over SMB ADMIN$ | 5145 | Secretdump
TA0006-Credential Access | T1003.002-Security Account Manager | SAM database access during DCshadow | 4661 | DCShadow
TA0006-Credential Access | T1003.003-NTDS | IFM created | 325 or 327 | 
TA0006-Credential Access | T1003.003-NTDS | IFM created from command line | 1 or 4688 | 
TA0006-Credential Access | T1003.003-OS Credential-Dumping NTDS | DSRM configuration changed (Reg via command) | 1 or 4688 | 
TA0006-Credential Access | T1003.003-OS Credential-Dumping NTDS | DSRM configuration changed (Reg via PowerShell) | 800 or 4103 or 4104 | 
TA0006-Credential Access | T1003.003-OS Credential-Dumping NTDS | DSRM password reset | 4794 | 
TA0006-Credential Access | T1003.006-DCSync | Member added to a Exchange DCsync related group  | 4728 or 4756 or 4732 | DCSync
TA0006-Credential Access | T1003-Credential dumping | Backdoor introduction via registry permission change through WMI (DAMP) | 4674 | DAMP
TA0006-Credential Access | T1003-Credential dumping | Diskshadow abuse | 1 or 4688 | 
TA0006-Credential Access | T1003-Credential dumping | Wdigest authentication enabled (Reg via command) | 1 or 4688 | 
TA0006-Credential Access | T1003-Credential dumping | Wdigest authentication enabled (Reg via Sysmon) | 12 or 12 | 
TA0006-Credential Access | T1040-Network sniffing | Windows native sniffing tool Pktmon usage | 1 or 4688 | 
TA0006-Credential Access | T1110.xxx-Brut force | Brutforce enumeration on Windows OpenSSH server with non existing user | 4625 or 4 | SSH server
TA0006-Credential Access | T1110.xxx-Brut force | Brutforce on Windows OpenSSH server with valid user | 4625 or 4 | SSH server
TA0006-Credential Access | T1110.xxx-Brut force | Kerberos brutforce enumeration with existing/unexsting users (Kerbrute) | 4771 or 4768 | 
TA0006-Credential Access | T1110.xxx-Brut force | Kerberos brutforce with not existing users | 4771 or 4768 | 
TA0006-Credential Access | T1110.xxx-Brut force | Local login failure on target | 4625 | 
TA0006-Credential Access | T1110.xxx-Brut force | Login failure from a single source with different non existing accounts | 33205 | 
TA0006-Credential Access | T1552.004-Unsecured Credentials-Private Keys | Unknown application accessing certificate private key detected | 70(CAPI2) | Mimikatz
TA0006-Credential Access | T1555.003-Credentials from Password Stores: Credentials from Web Browsers | User browser credentials dump via network share | 5145 | DonPapi, Lazagne
TA0006-Credential Access | T1555.004-Windows Credential Manager | Credentials (protected by DPAPI) dump via network share | 5145 | DonPapi, Lazagne
TA0006-Credential Access | T1555.004-Windows Credential Manager | Vault credentials were read | 5382 | 
TA0006-Credential Access | T1555-Credentials from Password Stores | Suspicious Active Directory DPAPI attributes accessed | 4662 | 
TA0006-Credential Access | T1555-Credentials from Password Stores | User files dump via network share | 5145 | DonPapi, Lazagne
TA0006-Credential Access | T1557.001-MiM:LLMNR/NBT-NS Poisoning and SMB Relay | Discovery for print spooler bug abuse via named pipe | 5145 | 
TA0006-Credential Access | T1557.001-MiM:LLMNR/NBT-NS Poisoning and SMB Relay | DNS wildcard zone entry | 515 | 
TA0006-Credential Access | T1558.001-Golden Ticket | Kerberos TGS ticket request related to a potential Golden ticket | 4769 | Golden ticket
TA0006-Credential Access | T1558.001-Golden Ticket | SMB Admin share accessed with a forged Golden ticket | 5140 or 5145 | Golden ticket
TA0006-Credential Access | T1558.001-Golden Ticket | Success login impersonation with forged Golden ticket | 4624 | Golden ticket
TA0006-Credential Access | T1558.003-Kerberoasting | KerberOAST ticket (TGS) request detected (low encryption) | 4769 | Kerberoast
TA0006-Credential Access | T1558.004-Steal or Forge Kerberos Tickets: AS-REP Roasting | Kerberos AS-REP Roasting ticket request detected | 4768 | AS-REP Roasting
TA0006-Credential Access | T1558-Steal or Forge Kerberos Tickets | Kerberos ticket without a trailing $  | 4768 or 4769 | CVE-2021-42278/42287 & SAM-the-admin
TA0006-Credential Access | T1558-Steal or Forge Kerberos Tickets | Suspicious Kerberos proxiable ticket | 4768 | CVE-2021-42278/42287 & SAM-the-admin
TA0006-Credential Access | T1649- Steal or Forge Authentication Certificates  | ADCS ESC1 certificate request | 39 | 
TA0006-Credential Access | T1649- Steal or Forge Authentication Certificates  | ADCS ESC2 certificate request | 4886 or 4887 | 
TA0006-Credential Access | T1649- Steal or Forge Authentication Certificates  | ADCS ESC3 certificate request | 4886 or 4887 | 
TA0006-Credential Access | T1649- Steal or Forge Authentication Certificates  | ADCS ESC7 permission change | 4882 | 
TA0007-Discovery | T1016-System Network Configuration Discovery | Firewall configuration enumerated (command) | 1 or 4688 | 
TA0007-Discovery | T1016-System Network Configuration Discovery | Firewall configuration enumerated (PowerShell) | 800 or 4103 or 4104 | 
TA0007-Discovery | T1016-System Network Configuration Discovery | Tentative of zone transfer from a non DNS server detected | 6004 (DNSserver) | 
TA0007-Discovery | T1018-Remote System Discovery | DNS hosts file accessed via network share | 5145 | 
TA0007-Discovery | T1046-Network Service Scanning | RDP discovery performed on multiple hosts | 131 | 
TA0007-Discovery | T1046-Network Service Scanning | Suspicious anonymous login | 4624 | 
TA0007-Discovery | T1069.001-Discovery domain groups | Local domain group enumeration via RID brutforce | 4661 | CrackMapExec
TA0007-Discovery | T1069.001-Discovery local groups | Remote local group enumeration (SharpeHound) | 4799 | SharpHound
TA0007-Discovery | T1069.002-Discovery domain groups | Domain group enumeration | 4661 | CrackMapExec
TA0007-Discovery | T1069.002-Discovery domain groups | Honeypot object (container, computer, group, user) enumerated | 4662 | SharpHound
TA0007-Discovery | T1069.002-Discovery domain groups | Massive SAM domain users & groups discovery | 4661 | 
TA0007-Discovery | T1069.002-Discovery domain groups | Sensitive SAM domain user & groups discovery | 4661 | 
TA0007-Discovery | T1069-Permission Groups Discovery | Group discovery via commandline | 1 or 4688 | 
TA0007-Discovery | T1069-Permission Groups Discovery | Group discovery via PowerShell | 800 or 4103 or 4104 | 
TA0007-Discovery | T1082-System Information Discovery | Audit policy settings collection | 1 or 4688 | 
TA0007-Discovery | T1087.002-Domain Account discovery | Active Directory PowerShell module called from a non administrative host | 600 | 
TA0007-Discovery | T1087.002-Domain Account discovery | Single source performing host enumeration over Kerberos ticket (TGS) detected | 4769 | SharpHound
TA0007-Discovery | T1087-Account discovery | SPN enumeration (command) | 1 or 4688 | Kerberoast
TA0007-Discovery | T1087-Account discovery | SPN enumeration (PowerShell) | 800 or 4103 or 4104 | 
TA0007-Discovery | T1087-Account discovery | User enumeration via commandline | 1 or 4688 | 
TA0007-Discovery | T1135-Network Share Discovery | Host performing advanced named pipes enumeration on different hosts via SMB | 5145 | SharpHound
TA0007-Discovery | T1135-Network Share Discovery | Network share discovery and/or connection via commandline | 1 or 4688 | 
TA0007-Discovery | T1135-Network Share Discovery | Network share manipulation via commandline | 1 or 4688 | 
TA0007-Discovery | T1201-Password Policy Discovery | Domain password policy enumeration | 4661 | CrackMapExec
TA0007-Discovery | T1201-Password Policy Discovery | Password policy discovery via commandline | 1 or 4688 | 
TA0007-Discovery | T1482-Domain Trust Discovery | Active Directory Forest PowerShell class called from a non administrative host | 800 or 4103 or 4104 | 
TA0008-Lateral Movement | T1021.001-Remote Desktop Protocol | Denied RDP login with valid credentials | 4825 | 
TA0008-Lateral Movement | T1021.002-SMB Windows Admin Shares | Admin share accessed via SMB (basic) | 5140 or 5145 | 
TA0008-Lateral Movement | T1021.002-SMB Windows Admin Shares | Impacket WMIexec execution via SMB admin share | 5145 | WMIexec
TA0008-Lateral Movement | T1021.002-SMB Windows Admin Shares | Lateral movement by mounting a network share - net use (command) | 4688 and 4648 | 
TA0008-Lateral Movement | T1021.002-SMB Windows Admin Shares | Multiple failed attempt to network share | 5140 or 5145 | 
TA0008-Lateral Movement | T1021.002-SMB Windows Admin Shares | New file share created on a host | 5142 | 
TA0008-Lateral Movement | T1021.002-SMB Windows Admin Shares | Psexec remote execution via SMB | 5145 | 
TA0008-Lateral Movement | T1021.002-SMB Windows Admin Shares | Remote service creation over SMB | 5145 | 
TA0008-Lateral Movement | T1021.002-SMB Windows Admin Shares | Remote shell execuction via SMB admin share | 5145 | 
TA0008-Lateral Movement | T1021.002-SMB Windows Admin Shares | Shared printer creation | 5142 | PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
TA0008-Lateral Movement | T1021.003-DCOM | DCOM lateral movement (via MMC20) | 4104 | 
TA0008-Lateral Movement | T1021.003-DCOM | DCOMexec privilege abuse | 4674 | 
TA0008-Lateral Movement | T1021.003-DCOM | DCOMexec process abuse via MMC | 1 or 4688 | 
TA0008-Lateral Movement | T1021.004-Remote services: SSH | OpenSSH native server feature installation | 800 or 4103 or 4104 | SSH server
TA0008-Lateral Movement | T1021.004-Remote services: SSH | OpenSSH server for Windows activation/configuration detected | 800 or 4103 or 4104 | SSH server
TA0008-Lateral Movement | T1021.006-Windows Remote Management | WinRM listening service reconnaissance | 4656 | 
TA0008-Lateral Movement | T1550.002-Use Alternate Authentication Material: Pass the Hash | LSASS dump via process access | 10 | Mimikatz
TA0008-Lateral Movement | T1550.002-Use Alternate Authentication Material: Pass the Hash | Pass-the-hash login | 4624 | Mimikatz
TA0008-Lateral Movement | T1563.002-RDP hijacking | RDP session hijack via TSCON abuse command | 1 or 4688 | 
TA0009-Collection | T1125-Video capture | RDP shadow session started (registry) | 13 | 
TA0011-Command and control | T1090-Proxy | Proxy configuration changed | 5600 | 
TA0011-Command and control | T1572-Protocol tunneling | RDP tunneling configuration enabled for port forwarding | 1 or 4688 | 
TA0040-Impact | T1490-Inhibit System Recovery | VSS backup deletion (PowerShell) | 800 or 4103 or 4104 | 
TA0040-Impact | T1490-Inhibit System Recovery | VSS backup deletion (WMI) | 1 or 4688 | 
TA0040-Impact | T1490-Inhibit System Recovery | Windows native backup deletion | 1 or 4688 | 
TA0040-Impact | T1565-Data manipulation | DNS hosts file modified | 11 |

EVTX-to-MITRE-Attack

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

EVTX-to-MITRE-Attack

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README