Reference tables for IOC Detection Rules

imageLoadEvent

Triggered when a process loads a DLL or executable image into memory.

Detect DLL injections or unauthorized image loads.

Identify in-memory attacks or stealthy execution techniques.

fileWriteEvent

Triggered when a file is created or modified on the endpoint.

Monitor for malicious files being written (by name, path, or hash).

Detect malware payloads, persistence artifacts, or dropped files.

regKeyEvent

Triggered when a registry key is created, modified, or deleted.

Track changes in sensitive registry locations.

Detect persistence mechanisms and attempts to disable security controls.

dnsLookupEvent

Triggered when a DNS query is made.

Match domain names against known malicious or suspicious patterns.

Identify malware communication with C2 infrastructure using DNS.

ipv4NetworkEvent

Triggered when IPv4 network communication occurs (e.g., TCP/UDP).

Watch for connections to suspicious or known malicious IPs.

Detect lateral movement, C2 traffic, or data exfiltration attempts.

urlMonitorEvent

Triggered when a process accesses a URL.

Detect access to malicious or suspicious URLs.

Capture web-based threat activity such as phishing, malware download, or beaconing.

addressNotificationEvent

Triggered when a process binds to a network address or port.

Identify processes listening on ports or opening local servers.

Detect tools and malware preparing for communication, remote access, or lateral movement.

processEvent

Triggered when a process is created on the endpoint

Track process creation, analyze parent-child relationships, and inspect command-line arguments.

Detect abnormal process behavior, identify execution chains, or investigate process-based attacks.

timestamp

The date and time when the event occurred.

Set time-based rules to detect events within specific timeframes. Correlate activity or focus on a specific period (e.g., incident window).

Use it to correlate activity or focus on a specific period (e.g., incident window).

fullPath

Full file path including drive, folder, and file name.

Match against known malicious or suspicious file paths.

Use it when tracking specific files or malware locations.

devicePath

Path as represented by the OS device namespace (e.g., \Device\Harddisk...).

Detect low-level disk or device access paths.

Use it for advanced detection involving raw device paths or bypass techniques.

drive

The drive letter (e.g., C:, D:) where the file or event occurred.

Filter based on drive usage.

Use it when threats are known to target specific drives (e.g., removable media).

filePath

Directory path of the file, excluding the file name

Target files in specific folders.

Use it for watching known malware directories or temporary file storage paths.

fileName

The name of the file (excluding extension).

Match files by name regardless of location or extension.

Use it when malware uses a consistent file name across variants.

fileExtension

The file’s extension (e.g., .exe, .dll, .bat).

Detect execution of risky or unauthorized file types.

Use it to monitor specific file types commonly abused by attackers.

size

Size of the file in bytes.

Set conditions for unusually large or small files.

Use it to detect payloads that fall within a known size range.

md5

The MD5 hash of the file or process.

Match against known malware or IOC hashes.

Use it for high-confidence threat detection using hash intelligence.

pid

Process ID of the running process.

Link events to a specific process.

Use it in combination with process-related fields to track activity of a single process instance.

process

Name of the process that triggered the event.

Monitor specific executables.

Use it to track known malicious or suspicious processes (e.g., powershell.exe).

processPath

Full path of the executing process.

Detect execution from suspicious locations.

Use it to catch legitimate binaries run from unexpected or malicious locations.

parentProcessPath

Full path of the parent process.

Trace process lineage and identify spawning behavior.

Use it when detecting process injection, LOLBins, or abnormal parent-child relationships.

writes

Indicates whether the file was written to.

Set as a boolean condition (true or false).

Use it to detect payload delivery or modification attempts.

numBytesSeenWritten

Number of bytes written to a file.

Detect unusually large writes.

Use it to flag potential payload drops or data exfiltration to disk

lowestFileOffsetSeen

The lowest byte offset written in the file.

Track where the file content begins.

Use it to detect overwritten system files or dropped payloads.

dataATLowestOffSet

Raw data at the lowest file offset (hex or ASCII).

Match known binary signatures or headers.

Use it for detecting file types or embedded threats (e.g., PE headers).

textAtLowestOffset

Text string at the lowest file offset.

Match ASCII-based patterns.

Use it when identifying scripts, strings, or identifiable headers in written files.

closed

Indicates whether the file or handle was closed.

Boolean value to confirm file access completion.

Use it to filter completed file operations only.

error

Error code associated with the operation.

Detect failed or suspicious file or registry operations.

Use it when attackers trigger or exploit access errors or blocked writes.

username

Username of the account performing the action.

Match against known users or detect unknown/malicious activity.

Use it for attribution, insider threat detection, or privilege abuse monitoring.

Contains

Matches if the field value includes the specified substring.

filePath contains \temp\

Use when the string might appear anywhere in the field.

Does Not Contain

Matches if the field value does not include the substring.

filePath does not contain \Windows\

Use to exclude known safe paths or benign activity.

Equals

Matches if the field value is exactly equal to the value.

fileName equals cmd.exe

Use when matching known exact values like file names, hashes, or usernames.

Does Not Equal

Matches if the field value is not equal to the value.

process does not equal explorer.exe

Use to ignore safe or known good processes.

Matches

Matches if the field value fits the regular expression.

filePath matches .*\\AppData\\Roaming\\.*

Use for advanced pattern matching or flexible conditions.

Does Not Match

Matches if the field value does not fit the regex pattern.

fileName does not match ^temp.*\.exe$

Use to exclude values that follow a specific pattern.

Starts With

Matches if the field value begins with the string.

processPath starts with C:\Users\

Use to detect behavior in specific root folders or user directories.

Does Not Start With

Matches if the field value does not begin with the string.

processPath does not start with C:\Windows\

Use to filter out system processes or files.

Ends With

Matches if the field value ends with the string.

fileName ends with .bat

Use to detect specific file types or extensions.

Does Not End With

Matches if the field value does not end with the string.

fileName does not end with .log

Use to exclude irrelevant file types from matching.