Detection Rules

AWS-3001 · T1110, T1078.004

AWS Console Login Brute Force

AWS-3002 · T1078.004

AWS Root Account Usage

EMAIL-8001 · T1566.001

Dangerous Attachment Type Delivered to a Mailbox

EMAIL-8002 · T1656

Email Delivered Despite Failing DMARC Authentication

EMAIL-8003 · T1566

Mass Phishing Campaign From a Single External Sender

EMAIL-8004 · T1656

Executive/Brand Impersonation Email Delivered

EMAIL-8005 · T1048

Large Outbound Attachment Sent to a Personal Webmail Domain

EMAIL-8006 · T1566.002

User-Reported Phishing Email

FW-7001 · T1595.001

Port Scan / Network Reconnaissance from a Single Source

FW-7002 · T1041

Large Outbound Data Transfer to an External Destination

FW-7003 · T1021.001

Administrative Port Allowed Inbound from an Untrusted Zone

FW-7004 · T1071

Repeated Blocked Outbound Connections Followed by a Successful One

FW-7005 · T1571

Outbound Connection to a Known C2-Associated Port

ID-9001 · T1078, T1078.004

Impossible Travel Sign-In Risk Detected

ID-9002 · T1114.003, T1098.002

Suspicious External Inbox Forwarding Rule Created

LIN-2001 · T1110, T1021.004

SSH Brute Force

LIN-2002 · T1548.003, T1078.003

Suspicious Sudo Command Execution

RP-7001 · T1090.004, T1190

TLS SNI and HTTP Host Header Mismatch (Domain Fronting / Host Injection)

RP-7002 · T1071.001

HTTP Request Smuggling Indicator (Conflicting Content-Length and Transfer-Encoding)

RP-7003 · T1595.002, T1190

Reverse Proxy Admin/Stats Interface Reachable

RP-7004 · T1499.004

Backend Origin Error Spike Behind Reverse Proxy

RP-7005 · T1190

Cache Poisoning via Spoofed X-Forwarded-Host on a Cached Response

SYS-4001 · T1566.001, T1059.001

Office Application Spawning Command Interpreter

SYS-4002 · T1105, T1218.010

LOLBin Used to Fetch a Remote Payload

SYS-4003 · T1574.002

Unsigned Image Loaded from a User-Writable Temp Directory

SYS-4004 · T1547.001

Executable Dropped into the Startup Folder

SYS-4005 · T1547.001

Registry Run Key Modified for Persistence

SYS-4006 · T1003.001

LSASS Accessed with Credential-Dumping Rights

SYS-4007 · T1219

Remote Monitoring & Management Tool Executed

WAF-5001 · T1190

SQL Injection Attempt Blocked

WAF-5002 · T1190, T1059.007

Cross-Site Scripting Attempt Blocked

WAF-5003 · T1190, T1083

Path Traversal / LFI Attempt Blocked

WAF-5004 · T1595

Repeated WAF Blocks From the Same Source (Scanning/Probing)

WAF-5005 · T1190, T1078

WAF Attack Signatures Followed by a Successful Login (Possible Successful Exploitation)

WEB-6001 · T1595.002

Known Vulnerability Scanner User-Agent

WEB-6002 · T1595.003

High Rate of 404s From the Same Client (Directory/File Brute Forcing)

WEB-6003 · T1190

Sensitive Admin Path Accessed Successfully

WEB-6004 · T1078

Successful Application Login

WEB-6005 · T1505.003

Web Shell-Style Request Pattern

WEBPROXY-9001 · T1071.001

Access to a Known-Malware Category URL Was Allowed

WEBPROXY-9002 · T1566.002

Access to a Newly Registered Domain

WEBPROXY-9003 · T1071.001

Repeated Requests to an Uncategorized Domain (Possible C2 Beaconing)

WEBPROXY-9004 · T1567

Large File Upload to a File-Sharing Site

WEBPROXY-9005 · T1071.001

Repeated Blocked Requests to a Domain Followed by a Successful One

WIN-1001 · T1110, T1110.001

Brute Force Logon Followed by Success

WIN-1002 · T1110.001, T1021.001

RDP Brute Force Attempt

WIN-1003 · T1098, T1136.001, T1078

New User Added to a Privileged Local Group

WIN-1004 · T1136.001, T1136.002

New User Account Created

WIN-1005 · T1550.002, T1021.002

Suspicious NTLM Network Logon (Possible Pass-the-Hash)

WIN-1006 · T1543.003, T1569.002

Windows Service Installed

WIN-1007 · T1070.001

Event Log Cleared

WIN-1008 · T1059.003, T1078.003

Interactive Shell Spawned Under a Service Account