Siemphony

BITS job creation or notify command set from the command line

0% noise measured in lab

Block device accessed or a disk-wiping utility run on Linux

Browser extension registered or force-installed via registry

Browser or mail client resolving a high-risk top-level domain

Browser profile artefact named on a non-browser command line

Browser writing executable content outside its download folder

Camera capture libraries loaded outside known video applications

Chained shell command downloads, chmods and runs a /tmp payload

Child process spawned by the WinRM shell host wsmprovhost.exe

0% noise measured in lab

chmod command sets the setuid or setgid bit on a file

Cleartext FTP upload of an archive or database dump

ClickOnce deployment invoked or abused via rundll32 or dfsvc

clip.exe launched by a one-shot shell, script or service

Cloud account enumeration cmdlets in a PowerShell script block

CLR profiler environment variable set in the registry

CMSTP profile installer executed on a Windows endpoint

0% noise measured in lab

Code repository domain resolved by a script host or transfer tool

Command interpreter spawned by an auto-elevated UAC bypass binary

0% noise measured in lab

Command line builds a new logon token for impersonation

Command line enumerating attached peripheral or USB devices

Command line naming a browser login-credential store

Command line naming a browser session cookie store

Command line naming a credential vault or password store file

Command line probes the host for hypervisor vendor artefacts