| DET0283 |
Behavior-chain detection for T1134 Access Token Manipulation on Windows |
T1134 |
| DET0482 |
Behavior-chain detection for T1134.001 Access Token Manipulation: Token Impersonation/Theft on Windows |
T1134.001 |
| DET0456 |
Behavior-chain detection for T1134.002 Create Process with Token (Windows) |
T1134.002 |
| DET0556 |
Behavior-chain detection strategy for T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild (Windows) |
T1127.001 |
| DET0151 |
Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery |
T1124 |
| DET0100 |
Behavioral Detection of Asynchronous Procedure Call (APC) Injection via Remote Thread Queuing |
T1055.004 |
| DET0389 |
Behavioral Detection of DLL Injection via Windows API |
T1055.001 |
| DET0102 |
Behavioral Detection of Input Capture Across Platforms |
T1056 |
| DET0089 |
Behavioral Detection of Keylogging Activity Across Platforms |
T1056.001 |
| DET0529 |
Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls |
T1106 |
| DET0106 |
Behavioral Detection of PE Injection via Remote Memory Mapping |
T1055.002 |
| DET0508 |
Behavioral Detection of Process Injection Across Platforms |
T1055 |
| DET0295 |
Behavioral Detection of Thread Execution Hijacking via Thread Suspension and Context Switching |
T1055.003 |
| DET0221 |
Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS |
T1123 |
| DET0341 |
Clipboard Data Access with Anomalous Context |
T1115 |
| DET0234 |
Credential Dumping via Sensitive Memory and Registry Access Correlation |
T1003 |
| DET0493 |
Detect Abuse of Inter-Process Communication (T1559) |
T1559 |
| DET0335 |
Detect Abuse of XPC Services (T1559.003) |
T1559.003 |
| DET0275 |
Detect Adversary Deobfuscation or Decoding of Files and Payloads |
T1140 |
| DET0438 |
Detect Archiving via Custom Method (T1560.003) |
T1560.003 |
| DET0507 |
Detect browser session hijacking via privilege, handle access, and remote thread into browsers |
T1185 |
| DET0430 |
Detect Credentials Access from Password Stores |
T1555 |
| DET0271 |
Detect Domain Controller Authentication Process Modification (Skeleton Key) |
T1556.001 |
| DET0144 |
Detect Forged Kerberos Golden Tickets (T1558.001) |
T1558.001 |
| DET0241 |
Detect Forged Kerberos Silver Tickets (T1558.002) |
T1558.002 |
| DET0157 |
Detect Kerberoasting Attempts (T1558.003) |
T1558.003 |
| DET0522 |
Detect Kerberos Ticket Theft or Forgery (T1558) |
T1558 |
| DET0104 |
Detect Modification of Authentication Processes Across Platforms |
T1556 |
| DET0580 |
Detect Network Provider DLL Registration and Credential Capture |
T1556.008 |
| DET0037 |
Detect Suspicious Access to Browser Credential Stores |
T1555.003 |
| DET0057 |
Detect Suspicious Access to securityd Memory for Credential Extraction |
T1555.002 |
| DET0134 |
Detect Suspicious Access to Windows Credential Manager |
T1555.004 |
| DET0597 |
Detect Unauthorized Access to Password Managers |
T1555.005 |
| DET0420 |
Detect User Activity Based Sandbox Evasion via Input & Artifact Probing |
T1497.002 |
| DET0433 |
Detecting Code Injection via mavinject.exe (App-V Injector) |
T1218.013 |
| DET0011 |
Detecting Junk Data in C2 Channels via Behavioral Analysis |
T1001.001 |
| DET0593 |
Detecting OS Credential Dumping via /proc Filesystem Access on Linux |
T1003.007 |
| DET0440 |
Detecting PowerShell Execution via SyncAppvPublishingServer.vbs Proxy Abuse |
T1216.002 |
| DET0034 |
Detection of Adversarial Process Discovery Behavior |
T1057 |
| DET0097 |
Detection of Application Window Enumeration via API or Scripting |
T1010 |
| DET0513 |
Detection of Cached Domain Credential Dumping via Local Hash Cache Access |
T1003.005 |
| DET0363 |
Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence |
T1003.001 |
| DET0139 |
Detection of Credential Harvesting via API Hooking |
T1056.004 |
| DET0426 |
Detection of Direct Volume Access for File System Evasion |
T1006 |
| DET0007 |
Detection of Domain Trust Discovery via API, Script, and CLI Enumeration |
T1482 |
| DET0437 |
Detection of LSA Secrets Dumping via Registry and Memory Extraction |
T1003.004 |
| DET0328 |
Detection of Malicious Profile Installation via CMSTP.exe |
T1218.003 |
| DET0466 |
Detection of Script-Based Proxy Execution via Signed Microsoft Utilities |
T1216 |
| DET0509 |
Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts |
T1539 |
| DET0332 |
Detection Strategy for AutoHotKey & AutoIT Abuse |
T1059.010 |
| DET0173 |
Detection Strategy for Endpoint DoS via Service Exhaustion Flood |
T1499.002 |
| DET0174 |
Detection Strategy for Exploitation for Credential Access |
T1212 |
| DET0514 |
Detection Strategy for Exploitation for Privilege Escalation |
T1068 |
| DET0217 |
Detection Strategy for Extra Window Memory (EWM) Injection on Windows |
T1055.011 |
| DET0260 |
Detection Strategy for Forged Web Credentials |
T1606 |
| DET0577 |
Detection Strategy for Hijack Execution Flow through the KernelCallbackTable on Windows. |
T1574.013 |
| DET0422 |
Detection Strategy for IFEO Injection on Windows |
T1546.012 |
| DET0322 |
Detection Strategy for Junk Code Obfuscation with Suspicious Execution Patterns |
T1027.016 |
| DET0331 |
Detection Strategy for ListPlanting Injection on Windows |
T1055.015 |
| DET0246 |
Detection Strategy for MFA Interception via Input Capture and Smart Card Proxying |
T1111 |
| DET0324 |
Detection Strategy for Polymorphic Code Mutation and Execution |
T1027.014 |
| DET0045 |
Detection Strategy for Process Argument Spoofing on Windows |
T1564.010 |
| DET0544 |
Detection Strategy for Process Doppelgänging on Windows |
T1055.013 |
| DET0382 |
Detection Strategy for Process Hollowing on Windows |
T1055.012 |
| DET0300 |
Detection Strategy for Reflective Code Loading |
T1620 |
| DET0388 |
Detection Strategy for T1548.002 – Bypass User Account Control (UAC) |
T1548.002 |
| DET0352 |
Detection Strategy for T1550.003 - Pass the Ticket (Windows) |
T1550.003 |
| DET0467 |
Detection Strategy for TLS Callback Injection via PE Memory Modification and Hollowing |
T1055.005 |
| DET0087 |
Encrypted or Encoded File Payload Detection Strategy |
T1027.013 |
| DET0474 |
Environmental Keying Discovery-to-Decryption Behavioral Chain Detection Strategy |
T1480.001 |
| DET0118 |
Exploitation of Remote Services – multi-platform lateral movement detection |
T1210 |
| DET0368 |
Hardware Supply Chain Compromise Detection via Host Status & Boot Integrity Checks |
T1195.003 |
| DET0023 |
Obfuscated Binary Unpacking Detection via Behavioral Patterns |
T1027.002 |
| DET0491 |
Peripheral Device Enumeration via System Utilities and API Calls |
T1120 |
| DET0105 |
Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools |
T1110.002 |
| DET0168 |
Virtualization/Sandbox Evasion via System Checks across Windows, Linux, macOS |
T1497.001 |
| DET0026 |
Windows Detection Strategy for T1547.012 - Print Processor DLL Persistence |
T1547.012 |