Search and filter across all detection sources
4 rules
Potential Reverse Shell Activity via Terminal
Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity.
Credential Access via Known Utilities
Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access.
RunDLL32 with Unusual Arguments
Identifies unusual instances of RunDLL32 with suspicious keywords or paths in the process command line value. Adversaries may abuse rundll32.exe to proxy execution of malicious code.
Remote File Execution via MSIEXEC
Identifies the execution of the built-in Windows Installer, MSIEXEC, with a url in the command line. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files.