CAR-1: Attempt To Add Certificate To Untrusted Store.CAR-1: Common Windows Process Masquerading.CAR-9: Detecting Shadow Copy Deletion via Vssadmin.exe.CAR-7: Detecting Tampering of Windows Defender Command Prompt.CAR-6: Unusual Child Process spawned using DDE exploit.CAR-4: Unusual Child Process for Spoolsv.Exe or Connhost.Exe.CAR-3: Clearing Windows Logs with Wevtutil.CAR-2: Unusually Long Command Line Strings.CAR-1: Identifying Port Scanning Activity.CAR-7: Network Share Connection Removal.CAR-6: Local Permission Group Discovery.CAR-5: Clear Powershell Console Command History.CAR-1: Boot or Logon Initialization Scripts.CAR-3: Indicator Blocking - Driver Unloaded.CAR-2: Component Object Model Hijacking.CAR-2: NTFS Alternate Data Stream Execution - LOLBAS.CAR-1: NTFS Alternate Data Stream Execution - System Utilities.CAR-2: Active Directory Dumping via NTDSUtil.CAR-1: Credential Dumping via Windows Task Manager.CAR-1: Remotely Launched Executables via WMI.CAR-6: Windows Remote Management (WinRM).

CAR-3: Debuggers for Accessibility Applications.CAR-1: Service Search Path Interception.CAR-5: Remotely Launched Executables via Services.CAR-5: Command Line Usage of Archiving Software.CAR-9: Running executables with same hash and different names.CAR-2: Quick execution of a series of suspicious commands.CAR-1: Reg.exe called from Command Shell.It collects system information while running in the background and supports storing it in the Windows Event Log. Sysmon is a freely available program from Microsoft that is provided as part of the Windows Sysinternals suite of tools.

Sysinternals suite 2014