Views:
June 5, 2025—Trend Vision One supports new custom detection filters for Microsoft.
Try these detection filters to enhance Microsoft log analysis:
  • Possible theft of passwords and other sensitive web browser information
  • Backdoor Detected
  • Backdoor Prevented
  • BloodHound Process Detection
  • CertUtil Remote Download
  • Hacktool Detected
  • Hacktool Prevented
  • Malware Detected
  • Ransomware Prevented
  • Remote exfiltration activity
  • Suspicious Hacking Tool Detected
  • Unwanted Software Prevented
  • Unwanted Software Detected
  • Wevtutil Clear Windows Event Logs
  • Windows Network Sniffing
  • AMSI Script Detection
  • Possible ongoing hands-on-keyboard activity (Cobalt Strike)
Download these custom detection filters from GitHub. For more information see Custom filters.
XDR Threat Investigation → Detection Model Management