Siemphony

Detect a defensive service terminating unexpectedly

Detect a document or archive application spawning a system utility

Detect a document or browser process spawning a scripting host

Detect a file-transfer utility launched by the task scheduler

Detect a hand-rolled character-table encoder in a script block

Detect a process opening a browser with injection access rights

Detect an interpreter launched from the shell with a pasted one-liner

Detect archiving utilities run with an archive-creating verb

0% noise measured in lab

Detect browser launched with a sideloaded extension flag

Detect COM registration utility running a user-writable assembly

0% noise measured in lab

Detect DNS lookups for bandwidth-monetization proxyware services

Detect encoding or encryption of files under sensitive paths

Detect execution of built-in network configuration utilities

Detect failed remote logons against commonly guessed accounts

Detect FTP or TFTP connection from a script host or proxy binary

Detect job scheduling through the legacy at utility

0% noise measured in lab

Detect mining pool and miner arguments in process command lines

Detect MSBuild spawning a script interpreter or signed-binary proxy

Detect net view used to enumerate hosts and shares on the network

0% noise measured in lab

Detect network share enumeration from the command line

Detect packet capture libraries loaded outside a capture install

Detect password hash cracking tool execution on a host

Detect scheduled task registered with a suspicious action

Detect system time and time zone discovery on the command line