►PowerShell downloading files with Invoke-WebRequest or WebClientT1059.001

►cmd.exe spawned directly by a browser processT1059.003

►mshta.exe executing a remote script URLT1218.005

►regsvr32.exe loading a DLL from a network path — SquiblydooT1218.010

►certutil.exe used to decode or download a payloadT1140

►wmic.exe spawning unexpected child processesT1047

►rundll32.exe calling an uncommon or suspicious exportT1218.011

►executables launched from user temp or download directoriesT1036.005

►scripts running from %APPDATA% or %LOCALAPPDATA%T1059

►double-extension files — invoice.pdf.exe or report.docx.scrT1036.007

►ntdsutil.exe accessing the Active Directory databaseT1003.003

►vssadmin deleting or resizing shadow copies — ransomware precursorT1490

►SAM registry hive read by a non-system processT1003.002

►LSASS memory access from an unsigned or unexpected processT1003.001

►procdump.exe or comsvcs.dll MiniDump targeting lsassT1003.001

►secretsdump or impacket patterns in process command linesT1003

►Kerberoasting — unusual LDAP queries for service principal namesT1558.003

►DCSync — AD replication requests originating from a non-DCT1003.006

►LaZagne or credential harvesting tool name in process listT1555

►Windows Credential Editor or wce.exe executionT1003.001

►PsExec or similar remote execution tool activityT1570

►WMI remote process creation across multiple endpointsT1021.006

►RDP connections between workstations — not server to clientT1021.001

►DCOM lateral movement via MMC20 or ShellBrowserWindowT1021.003

►net use commands mounting administrative sharesT1021.002

►schtasks /s creating scheduled tasks on remote hostsT1053.005

►sc.exe installing a service remotelyT1569.002

►unexpected SSH lateral movement from internal Windows hostsT1021.004

►WinRM connections from non-privileged workstationsT1021.006

►NTLM authentication with mismatched source hostname — pass-the-hashT1550.002

►new Windows services installed outside of known patch windowsT1543.003

►unsigned DLLs appearing in System32 — DLL hijackingT1574.001

►COM object hijacking entries written to HKCU hiveT1546.015

►startup folder file drops by non-installer processesT1547.001

►WMI event subscriptions created or modifiedT1546.003

►AppInit_DLLs registry key written by a user processT1546.010

►screensaver executable path changed in user registryT1546.002

►LSA security package or notification package modificationsT1547.005

►Office template file modifications — macro persistenceT1137.001

►BITS jobs created by unexpected processesT1197

►DNS TXT record queries — potential DNS tunneling or exfiltrationT1048.003

►large outbound data transfer to a new external destinationT1041

►rclone or cloud sync tools running outside business hoursT1567.002

►adfind.exe Active Directory reconnaissance commandsT1018

►nltest.exe domain trust or DC enumerationT1482

►net group domain admins enumeration from a workstationT1069.002

►internal port scan or ping sweep from a user endpointT1046

►curl or wget downloading an executable to a temp pathT1105

►high-entropy command line arguments — obfuscation or encodingT1027

►outbound connections on non-standard ports from Office applicationsT1571