Title	Level	Status	Product	Author	Created
AWS Bucket Block Public Access Weakened Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs. Monitoring ...	medium	experimental	aws	Shoban Chiddarth	2026-10-21
HackTool - GoldenDMSA Execution Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation....	high	experimental	-	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-21
Potential HackTool - Defendnot Security Center AV Registry Modification Detects modification of the Microsoft Security Center AV registry keys, particularly those related w...	medium	experimental	-	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-19
HackTool - Defendnot Installation via PowerShell One-Liner Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the...	high	experimental	-	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-19
HackTool - Defendnot Default Scheduled Task Activity Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Wind...	high	experimental	windows	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-19
HackTool - Defendnot Execution Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undoc...	high	experimental	-	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-19
Registry Tampering Of Internal Tools Settings Detects registry modifications that tamper with internal Windows tools settings, commonly used by ma...	medium	experimental	-	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-18
Shell Spawned by Celery Worker Process Detects a system shell interpreter being spawned directly by a Celery worker process. This behavior ...	medium	experimental	-	Jennifer Batina	2026-10-17
Add Authorized Applications to Microsoft Defender Firewall via Registry Detects the degradation of the system firewall security by the creation or re-enabling of per-applic...	medium	experimental	-	frack113	2026-10-13
Allow Exceptions in Microsoft Defender Firewall via Registry Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value bei...	medium	experimental	-	frack113	2026-10-13
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands ...	medium	experimental	windows	Norbert Jaśniewicz (AlphaSOC)	2026-10-06
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShe...	high	experimental	windows	Norbert Jaśniewicz (AlphaSOC), Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-06
Suspicious WSL Binary Hijack via Proxy Execution Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL...	high	experimental	-	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-02
Uncommon Child Process Spawned From XBootMgrSleep.EXE Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe. XBootMgrSleep.exe is a Micro...	medium	experimental	-	Diablo Research	2026-10-02
Potential WSL Binary Modification from Installed Location Detects the modification of the wsl.exe binary from its installed location. Attackers can replace th...	medium	experimental	-	Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-02
Potential WSL InstallLocation Registry Key Modification Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key. Attacke...	medium	experimental	-	Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-02
Suspicious WSL InstallLocation Registry Key Modification Via CommandLine Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-...	high	experimental	-	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-02
Suspicious WSL Binary Masquerading Detects execution of masqueraded wsl.exe binary. Attackers can rename a malicious payload to wsl.exe...	high	experimental	-	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-02
Windows AppX Deployment Unsigned Package Installation Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXD...	medium	experimental	windows	Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-09-03
Windows AppX Deployment Full Trust Package Installation Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated pr...	medium	experimental	windows	Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-09-03
PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet an...	low	experimental	windows	Tom3306	2026-08-19
New User Account Creation Attempt Via ADSI in CommandLine Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patt...	medium	experimental	-	William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-08-19
New User Account Creation Attempt Via ADSI Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using...	medium	experimental	windows	William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-08-19
Suspicious Machine Account Replication - DcSync Indicator Detects suspicious Active Directory Replication Service (ADRS) requests originating from a machine a...	medium	test	windows	Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermett, Sorina Ionescu	2026-08-05
Potentially Suspicious Image Load of Offreg.dll Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enab...	medium	experimental	-	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-08-03

📬 Feedback & Feature Requests