Application Log Content refers to logs generated by applications or services, providing a record of their activity. These logs may include metrics, errors, performance data, and operational alerts from web, mail, or other applications. These logs are vital for monitoring application behavior and detecting malicious activities or anomalies. Examples:
| Name | Channel |
|---|---|
| android:logcat | Default IME active or bound to |
| android:logcat | Default IME changed/active: imeId= |
| android:logcat | Default IME active imeId= |
| android:logcat | addView TYPE_APPLICATION_OVERLAY|TYPE_APPLICATION_ATTACHED_DIALOG shown over |
| android:logcat | Secure/Global reads of device_policy_manager, accessibility_enabled, default_vpn, always_on_vpn |
| android:logcat | Task switch from browser/custom tab to handler immediately after OAuth return |
| android:logcat | ACTION_OPEN_DOCUMENT_TREE / ACTION_OPEN_DOCUMENT invoked without user gesture or repeatedly in background |
| Application Log | None |
| Application:Mail | smtpd$.*$: .*from=[.*@internaldomain.com](mailto:.*@internaldomain.com) to=[.*@internaldomain.com](mailto:.*@internaldomain.com) |
| Application:Mail | Inbound messages with anomalous headers, spoofed SPF/DKIM failures |
| Application:Mail | Inbound emails containing hyperlinks from suspicious sources |
| Application:Mail | Inbound email attachments logged from MTAs with suspicious metadata |
| Application:Mail | Mismatch between authenticated username and From header in email |
| Application:Mail | High-frequency inbound mail activity to a specific recipient address |
| ApplicationLog:API | Docker/Kubernetes API access from external sources |
| ApplicationLog:CallRecords | Outbound or inbound calls to high-risk or blocklisted numbers |
| ApplicationLog:EntraIDPortal | DeviceRegistration events |
| ApplicationLog:IIS | IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) |
| ApplicationLog:Ingress | Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes |
| ApplicationLog:Intune/MDM Logs | Enrollment events (e.g., MDMDeviceRegistration) |
| ApplicationLog:MailServer | Unexpected additions of sieve rules or filtering directives |
| ApplicationLog:Outlook | Outlook client-level rule creation actions not consistent with normal user activity |
| ApplicationLog:WebServer | /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors |
| AWS:bedrock | GuardrailTrace |
| AWS:bedrock | AgentTrace.FailureTrace |
| AWS:bedrock | AgentTrace.ModelInvocationInput |
| AWS:bedrock | AgentTrace.actionGroupInvocationInput |
| AWS:bedrock | AgentTrace.knowledgeBaseLookupInput |
| AWS:CloudTrail | SendEmail |
| AWS:CloudTrail | InvokeModel |
| AWS:CloudTrail | InvokeFunction: Unexpected or repeated invocation of functions not tied to known workflows |
| AWS:CloudTrail | CreateUser|AttachRolePolicy|CreateAccessKey|UpdateAssumeRolePolicy|CreateLoginProfile |
| AWS:CloudTrail | StopLogging, DeleteTrail, UpdateTrail: API calls that disable or modify logging services |
| AWS:CloudWatch | Repeated crash pattern within container or instance logs |
| AWS:CloudWatch | Elevated 5xx response rates in application logs or gateway layer |
| azure:activity | Add role assignment / ElevateAccess / Create service principal |
| azure:audit | App registrations or consent grants by abnormal users or at unusual times |
| azure:signinlogs | ConsentGrant: Suspicious consent grants to non-approved or unknown applications |
| azure:signinlogs | Modify Conditional Access Policy |
| azure:signinlogs | Register PTA Agent or Modify AD FS trust |
| azure:signinlogs | Resource access initiated using application credentials, not user accounts |
| casb:activity | Subsequent sensitive data access or outbound transfer occurs in the same SaaS session |
| device:VendorLog | protected function (firmware write, memory protection mode change) succeeds for a session that did not complete the documented authentication/privilege-elevation sequence |
| docker:daemon | container_create,container_start |
| docker:events | Container exited with non-zero code repeatedly in short period |
| docker:runtime | execution of cloud CLI tool (e.g., aws, az) inside container |
| EDR:detection | ThreatDetected, QuarantineLog |
| EDR:detection | ThreatLog |
| edr:TelemetryCompare | process enumeration discrepancy between Windows Management Instrumentation (WMI) and direct process listing |
| engineeringworkstation:ApplicationLog | firmware write session initiated without corresponding change ticket reference |
| engineeringworkstation:ApplicationLog | program download session logged without corresponding change ticket reference |
| engineeringworkstation:ApplicationLog | mode-change session logged without corresponding change ticket reference |
| engineeringworkstation:ApplicationLog | firmware update mode entry logged without corresponding change ticket reference |
| engineeringworkstation:ApplicationLog | Engineering application audit/session log: controller program upload initiated outside approved backup/change window and without documented backup purpose |
| engineeringworkstation:ApplicationLog | full upload session outside backup window schedule without documented backup purpose |
| engineeringworkstation:ApplicationLog | online edit session logged without corresponding change ticket reference |
| engineeringworkstation:ApplicationLog | firmware session initiated outside maintenance window schedule without change ticket reference |
| engineeringworkstation:ApplicationLog | device restart command initiated outside change control window by account not in approved engineer list |
| esxi:esxupdate | /var/log/esxupdate.log contains VIB installed with `--force` or `--no-sig-check` and non-standard acceptance levels |
| esxi:hostd | /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections |
| esxi:hostd | Keywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log. |
| esxi:hostd | unexpected script/command invocations via hostd |
| esxi:hostd | Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest |
| esxi:hostd | unexpected script invocations producing long encoded strings |
| esxi:hostd | Host daemon command log entries related to vib enumeration |
| esxi:hostd | New extension/module install with unknown vendor ID |
| esxi:vmkernel | vmkernel / OpenSLP logs for malformed requests |
| esxi:vpxd | Symmetric crypto routines triggered for external session |
| esxi:vpxd | ESXi process initiating asymmetric handshake with external host |
| gcp:workspaceaudit | SendAs: Outbound messages with alias identities that differ from primary account |
| historian:applog | historian Structured Query Language (SQL) query returning above bulk query threshold rows from account not in approved historian clients |
| iOS:unifiedlog | Repeated or large UIPasteboard reads; background pasteboard access shortly before packaging |
| iOS:unifiedlog | UIPasteboard read (general/string/data) by |
| iOS:unifiedlog | UIWindow/UIView events indicating secure text entry focus, editingChanged bursts, unexpected firstResponder cycling |
| iOS:unifiedlog | Secure text entry focus and editingChanged bursts not typical for the app |
| iOS:unifiedlog | Presentation of credential-like view (UIAlertController with text fields / custom modal) not backed by system auth controller; frequent editingChanged in secureTextEntry fields |
| iOS:unifiedlog | Repeated canOpenURL checks across diverse schemes (≥N within short window) |
| iOS:unifiedlog | UIDocumentPickerViewController presented repeatedly without foreground interaction or with short dwell time |
| iOS:unifiedlog | repeated sandbox denials related to restricted process/system interfaces consistent with process-table querying attempts |
| iOS:unifiedlog | security-relevant kernel log messages indicating restricted system interface access attempts by app process (device-dependent visibility) |
| journald:Application | Segfault or crash log entry associated with specific application binary |
| journald:systemd | Repeated service restart attempts or unit failures |
| kubernetes:orchestrator | Access to orchestrator logs containing credentials (Docker/Kubernetes logs) |
| linux:cli | cleared or truncated .bash_history |
| linux:syslog | usb * new|thunderbolt|pci .* added|block.*: new .* device |
| linux:syslog | Inbound messages from webmail services containing attachments or URLs |
| linux:syslog | kernel|systemd messages indicating 'segmentation fault'|'core dumped'|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc. |
| linux:syslog | System daemons initiating encrypted sessions with unexpected destinations |
| linux:syslog | milter configuration updated, transport rule initialized, unexpected script execution |
| linux:syslog | Repetitive HTTP 408, 500, or 503 errors logged within short timeframe |
| linux:syslog | Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads |
| linux:syslog | processes binding to non-standard ports or sshd configured on unexpected port |
| linux:syslog | system daemons initiating TLS sessions outside expected services |
| linux:syslog | browser/office crash, segfault, abnormal termination |
| linux:syslog | Error/warning logs from services indicating load spike or worker exhaustion |
| linux:syslog | SPF fail OR DKIM fail OR DMARC fail OR mismatched from_domain vs return_path_domain |
| linux:syslog | suspicious DHCP lease assignment with unexpected DNS or gateway |
| linux:syslog | opened document|clicked link|segfault|abnormal termination|sandbox |
| linux:syslog | Authentication attempts into finance-related servers from unusual IPs or times |
| linux:syslog | sshd sessions with unusual port forwarding parameters |
| linux:syslog | Non-standard processes negotiating SSL/TLS key exchanges |
| linux:syslog | Module registration or stacktrace logs indicating segmentation faults or unknown module errors |
| linux:syslog | Segfaults, kernel oops, or crashes in security software processes |
| m365:exchange | Emails containing cleartext secrets (password=, api_key=, token=) shared across internal/external domains |
| m365:exchange | Transport Rule Modification |
| m365:exchange | Admin Audit Logs, Transport Rules |
| m365:exchange | MailDelivery: High-frequency delivery of messages or attachments to a single recipient |
| m365:exchange | New-InboxRule: Automation that triggers abnormal forwarding or external link generation |
| m365:exchange | MessageTrace logs |
| m365:exchange | External sender message followed by user action involving links or attachments |
| m365:mailboxaudit | Outlook rule creation or custom form deployment |
| m365:messagetrace | AuthenticationDetails=fail OR SPF=fail OR DKIM=fail OR DMARC=fail |
| m365:messagetrace | X-MS-Exchange-Organization-AutoForwarded |
| m365:purview | MailItemsAccessed & Exchange Audit |
| m365:purview | MailItemsAccessed, Search-Mailbox events |
| m365:teams | External chat request or new tenant communication preceding approval activity |
| m365:unified | CopilotInteraction |
| m365:unified | Authentication/account audit event identifying app-password or applicable legacy-authentication activity |
| m365:unified | Unusual form activity within Outlook client, including load of non-default forms |
| m365:unified | SendOnBehalf, MessageSend, ClickThrough, MailItemsAccessed |
| m365:unified | SendOnBehalf, MessageSend, AttachmentPreviewed |
| m365:unified | Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types |
| m365:unified | FileAccessed: Access of email attachments by Office applications |
| m365:unified | Creation or modification of inbox rule outside of normal user behavior |
| m365:unified | Send/Receive: Inbound emails containing embedded or shortened URLs |
| m365:unified | AppRegistration: Unexpected application registration or OAuth authorization |
| m365:unified | MessageSend, MessageRead, or FileAttached events containing credential-like patterns |
| m365:unified | Set-Mailbox, Add-InboxRule, RegisterWebhook |
| m365:unified | ConsentGranted: Abuse of application integrations to mint tokens bypassing MFA |
| m365:unified | Application Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise |
| m365:unified | Folder configuration updated with external or HTML-formatted Home Page via Set-MailboxFolder |
| m365:unified | PurgeAuditLogs, Remove-MailboxAuditLog |
| m365:unified | Set-CsOnlineUser or UpdateAuthPolicy |
| m365:unified | New-InboxRule or Set-InboxRule events recorded in Exchange Online |
| m365:unified | Transport rule or inbox rule creation events |
| m365:unified | GAL Lookup or Address Book download |
| m365:unified | Send/Receive: Inbound emails with attachments from suspicious or spoofed senders |
| m365:unified | certificate added or modified in application credentials |
| m365:unified | Unusual MFA requests or OAuth consent events temporally aligned with user-reported vishing call |
| m365:unified | Set federation settings on domain|Set domain authentication|Add federated identity provider |
| m365:unified | SendOnBehalf/SendAs: Emails sent where the sending identity mismatches account ownership |
| m365:unified | Set-MailboxAutoReplyConfiguration: Unexpected rule changes creating impersonated replies |
| m365:unified | SendOnBehalf/SendAs: Office Suite initiated messages using impersonated identities |
| m365:unified | Read-only configuration review from GUI |
| m365:unified | Modify Federation Settings or Update Authentication Policy |
| m365:unified | Send/Receive: Unusual spikes in inbound messages to a single recipient |
| m365:unified | PowerShell: Add-MailboxPermission |
| m365:unified | Add-MailboxPermission or Set-ManagementRoleAssignment |
| m365:unified | Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship |
| m365:unified | Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship |
| m365:unified | MailSend: Outlook messages with suspicious subject/body terms (e.g., urgent payment, wire transfer) targeting finance teams |
| m365:unified | FileAccessed, FileDownloaded, SearchQueried |
| m365:unified | Detection of hidden macro streams or SetHiddenAttribute actions |
| m365:unified | RunMacro |
| m365:unified | FileUploaded or FileCopied events |
| m365:unified | TeamsMessageAccess, TeamsExport, ExternalAppAccess |
| m365:unified | TeamsMessagesAccessedViaEDiscovery, TeamsGraphMessageExport |
| m365:unified | FileAccessed |
| m365:unified | ApplicationModified, ConsentGranted: Unexpected app consent or modification events linked to security evasion |
| m365:unified | MailItemsAccessed; AddedInboxRule; ConsentToApplication; SharingSet |
| m365:unified | Set-AdminAuditLogConfig;New-ApplicationAccessPolicy;ConsentToApplication |
| macos:jamf | RemoteCommandExecution |
| macos:unifiedlog | Device attached|enumerated VID/PID |
| macos:unifiedlog | Inbound email activity with suspicious domains or mismatched sender information |
| macos:unifiedlog | App/web server logs ingested via unified logging or filebeat (nginx/apache/node). |
| macos:unifiedlog | Received messages with embedded or shortened URLs |
| macos:unifiedlog | Received messages containing embedded links or attachments from non-enterprise services |
| macos:unifiedlog | process 'crashed'|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons. |
| macos:unifiedlog | opendirectoryd crashes or abnormal authentication errors |
| macos:unifiedlog | Logs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches |
| macos:unifiedlog | log stream cleared or truncated |
| macos:unifiedlog | quarantine or AV-related subsystem |
| macos:unifiedlog | Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console |
| macos:unifiedlog | Inbound messages with attachments from suspicious domains |
| macos:unifiedlog | Outgoing or incoming calls with non-standard caller IDs or unusual metadata |
| macos:unifiedlog | Mail.app or third-party clients sending messages with mismatched From headers |
| macos:unifiedlog | process crash, abort, code signing violations |
| macos:unifiedlog | Configuration profile modified or new profile installed |
| macos:unifiedlog | Crash log entries for a process receiving malformed input or known exploit patterns |
| macos:unifiedlog | Repetitive inbound email delivery activity logged within a short time window |
| macos:unifiedlog | Application errors or resource contention from excessive frontend or script invocation |
| macos:unifiedlog | SPF fail OR DKIM fail OR DMARC fail OR mismatched header vs envelope domains |
| macos:unifiedlog | new DHCP configuration with anomalous DNS or router values |
| macos:unifiedlog | Mail or AppleScript subsystem |
| macos:unifiedlog | opened document|clicked link|EXC_BAD_ACCESS|abort|LSQuarantine |
| macos:unifiedlog | Anomalous keychain access attempts targeting payment credentials |
| macos:unifiedlog | Abnormal terminations of com.apple.security.* or 3rd-party security daemons |
| networkdevice:controlplane | Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands |
| networkdevice:snmp | ifInErrors or ifOutDiscards rate exceeds baseline combined with cpu5min exceeding utilization threshold |
| networkdevice:snmp | Simple Network Management Protocol (SNMP) walk request from source not in approved Network Management System (NMS) Class Inter-Domain Routing (CIDR) subnet |
| networkdevice:snmp | Simple Network Management Protocol (SNMP) SET to alarm threshold Object Identifier (OID) from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| networkdevice:snmp | Simple Network Management Protocol (SNMP) polling inconsistency or syslog sequence gap suggesting telemetry manipulation |
| networkdevice:snmp | Simple Network Management Protocol (SNMP) SET to power Management Information Base (MIB) restart Object Identifier (OID) or Command Line Interface (CLI) reload command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| networkdevice:syslog | config push events |
| networkdevice:syslog | SIP REGISTER, INVITE, or unusual call destination metadata |
| networkdevice:syslog | Failed authentication requests redirected to non-standard portals |
| networkdevice:syslog | Network Address Translation (NAT)/route/Access Control List (ACL) configuration change from source not in approved net admins outside config change window |
| networkdevice:syslog | configuration change logged without corresponding change ticket reference following anomalous authentication |
| networkdevice:syslog | Access Control List (ACL)/policy change affecting alarm notification traffic ports without corresponding change ticket |
| networkdevice:syslog | unexpected listening port or routing table change following firmware update event |
| networkdevice:syslog | new Media Access Control (MAC) address learned on a switch port previously unused or assigned to a different device, followed by Industrial Control Systems (ICS) protocol traffic to field devices |
| networkdevice:syslog | management command succeeds from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, preceded by exploit-pattern traffic to management interface |
| networkdevice:syslog | syslog sequence number gap or forwarding interruption coinciding with suspicious activity window for the same device |
| networkdevice:syslog | Simple Network Management Protocol (SNMP) SET to service stop Object Identifier (OID) or Command Line Interface (CLI) command stopping critical service from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| networkdevice:syslog | AAA/Simple Network Management Protocol (SNMP) credential change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, followed by authentication failures from legitimate NMS systems |
| networkdevice:syslog | remote console or web management session from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| networkdevice:syslog | Access Control List (ACL) modification blocking Industrial Control Systems (ICS) reporting message ports while command ports remain open |
| networkdevice:syslog | unexpected restart or crash coinciding with anomalous traffic pattern on management interface |
| networkdevice:syslog | serial server configuration change altering port parameters for field device ports from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| networkdevice:syslog | unauthorized Switched Port Analyzer (SPAN) session request or port mirroring configuration from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| networkdevice:syslog | Switched Port Analayzer (SPAN) session or port mirroring configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| networkdevice:syslog | Access Control List (ACL)/firewall/routing configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window |
| networkdevice:syslog | interface shutdown command on Industrial Control Systems (ICS) device port from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window |
| networkdevice:syslog | deauthentication targeting more than mass deauth threshold enrolled devices within deauth time window, or Media Access Control (MAC) address filter config change excluding enrolled devices, from source not in approved wireless admin list |
| NSM:Connections | PushNotificationSent |
| NSM:Connections | Failed password or accepted password for SSH users |
| opc:applog | client_id not in approved Open Platform Communications (OPC) clients issuing high-volume read requests |
| opc:applog | Open Platform Communications (OPC) client polling frequency for tag set exceeds documented Human-Machine Interface (HMI) refresh baseline from client not in approved application list |
| opc:applog | Open Platform Communications Data Access (OPC DA) write queue depth or write throughput to a single point exceeds configured baseline by a significant margin |
| opc:applog | write to setpoint tag from client not in approved Open Platform Communications (OPC) clients with value outside baseline value range |
| opc:applog | client_id not in approved Open Platform Communications (OPC) clients traversing entire tag tree rather than known fixed subset |
| opc:applog | Open Platform Communications (OPC) client not in approved OPC clients calling BrowseNamespace traversing entire tag tree |
| opc:applog | command call to field device output tag from process not matching recognized Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) control application |
| opcua:AuditEvent | OPC UA AuditUpdateMethodEventType/AuditWriteUpdateEventType: ClientUserId, ClientApplicationUri, SourceNode/MethodId, Status and arguments for a state-changing method/write |
| otndr:BehaviorAlert | device Input/Output (I/O) state change inconsistent with programmed logic correlating temporally with operator terminal interaction |
| saas:application | High-frequency invocation of SMS-related API endpoints from publicly accessible OTP or verification forms (e.g., Twilio: SendMessage, Cognito: AdminCreateUser) with irregular destination patterns. |
| saas:application | High-volume API calls or traffic via messaging or webhook service |
| saas:audit | Actual send/share/upload/write operation |
| saas:audit | Rule/ConfigChange: Auto-forward rules, delegate assignments, or changes to financial approval workflows |
| saas:audit | Application added or consent granted: Integration persisting after original user disabled |
| saas:box | User navigated to admin interface |
| saas:collaboration | MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom) |
| saas:confluence | access.content |
| saas:email | AuthenticationFailures (SPF/DKIM/DMARC) OR Domain Mismatch |
| saas:finance | Transaction/Transfer: Unusual or large transactions initiated outside business hours or by unusual accounts |
| saas:github | Bulk access to multiple files or large volume of repo requests within short time window |
| saas:gmail | SendEmail, OpenAttachment, ClickLink |
| saas:googledrive | FileOpen / FileAccess: Event-driven script triggering on user file actions |
| saas:googleworkspace | OAuth2 authorization grants / Admin role assignments |
| saas:hubspot | contact_viewed, contact_exported, login |
| saas:okta | Conditional Access policy rule modified or MFA requirement disabled |
| saas:okta | MFAChallengeIssued |
| saas:okta | WebUI access to administrator dashboard |
| saas:okta | Federation configuration update or signing certificate change |
| saas:okta | System API Call: user.read, group.read |
| saas:okta | policy.rule.update;system.log.disable;admin.role.assign |
| saas:openai | High volume of requests to /v1/chat/completions or /v1/images/generations |
| saas:salesforce | DataExport, RestAPI, Login, ReportExport |
| saas:slack | file_upload, message_send, message_click |
| saas:slack | chat.postMessage, files.upload, or discovery API calls involving token/credential regex |
| saas:slack | OAuth token use by unknown app client_id accessing private channels or files |
| saas:slack | conversations.history, files.list, users.info, audit_logs |
| saas:slack | xternal DM or workspace invite preceding credential or approval actions |
| saas:Snowflake | QUERY: Large or repeated SELECT * queries to sensitive tables |
| saas:teams | ChatMessageSent, ChatMessageEdited, LinkClick |
| saas:zoom | unusual web session tokens and automation patterns during login |
| saas:zoom | Unexpected contact interaction preceding follow-on admin requests |
| scada:applog | device communication-loss alarm generated within detection window of a corresponding network flood alert |
| scada:applog | write Application Programming Interface (API) call queue depth or throughput to a single point exceeds max write queue depth |
| scada:applog | parameter write logged without corresponding operator_id in the Human-Machine Interface (HMI) audit trail |
| scada:applog | command issued to device_ip with no corresponding state-change confirmation received within command confirmation window |
| serialgw:syslog | serial port parameter change (baud rate, parity, port disable) without corresponding change ticket reference |
| syslog:auth | Secure Shell (SSH) session with X11 forwarding from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet |
| syslog:auth | Secure Shell (SSH) connection from source Internet Protocol (IP) address that appeared on Industrial Control Systems (ICS) network within new device window, not in approved device inventory |
| syslog:daemon | Industrial Control Systems (ICS) daemon log entry indicating connection limit exceeded, out of memory, or watchdog timeout |
| vendorapp:ApplicationLog | Industrial Control Systems (ICS) vendor application log shows endpoint or certificate change without documented maintenance reference |
| vpn:applog | session duration or command activity inconsistent with documented vendor support session profiles |
| webproxy:applog | file download from domain not matching verified vendor Transport Layer Security (TLS) certificate/domain history, immediately preceding the anomalous process spawn |
| webserver:applog | Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface; request-body claims require WAF/DPI logging |
| webserver:applog | Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface from unapproved source; request-body claims require WAF/DPI logging |
| WinEventLog:Application | Outlook errors loading or processing custom form templates |
| WinEventLog:Application | Office Add-in load errors, abnormal loading context, or unsigned add-in warnings |
| WinEventLog:Application | Outlook rule execution failure or abnormal rule execution context |
| WinEventLog:Application | Exchange Transport Service loads unusual .NET assembly or errors upon transport agent execution |
| WinEventLog:Application | Unexpected spikes in request volume, application-level errors, or thread pool exhaustion in web or API logs |
| WinEventLog:Application | Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events |
| WinEventLog:Application | Outlook logs indicating failure to load or render HTML page in Home Page view |
| WinEventLog:Application | EventCode=1000 |
| WinEventLog:Application | Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server) |
| WinEventLog:Application | SCCM, Intune logs |
| WinEventLog:Application | Unexpected web application errors or CMS logs showing modification to index.html, default.aspx, or other public-facing files |
| WinEventLog:Application | VPN, Citrix, or remote access gateway logs showing external IP addresses |
| WinEventLog:Application | Outlook rule creation, form load, or homepage redirection |
| WinEventLog:Application | High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite) |
| WinEventLog:Application | Exchange logs or header artifacts |
| WinEventLog:Application | Unusual DLL/plugin registration for IIS/SQL/Apache or unexpected error logs |
| WinEventLog:Application | wireless controller management log: SSID or MAC filter config change from account not in authorized wireless admins |
| WinEventLog:Security | EventCode=6416 |
| WinEventLog:Security | EventCode=1102 |
| WinEventLog:Security | EventCode=4663, 4670, 4656 |
| WinEventLog:System | Changes to applicationhost.config or DLLs loaded by w3wp.exe |
| WinEventLog:System | Device started/installed (UMDF) GUIDs |
| WinEventLog:System | EventCode=1000 |
| WinEventLog:System | EventCode=104 |
| WinEventLog:System | EventCode=1341, 1342, 1020, 1063 |
| WinEventLog:System | Industrial Control Systems (ICS) service failing to start (authentication failure) within credential change impact window of the password change event |
| WinEventLog:System | network adapter disabled on Industrial Control Systems (ICS) gateway host by process not in authorized network admins |