SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker uses RDP tunneling to redirect traffic to a C&C target.
Detects scenarios where an attacker failed to replace the original sethc.exe file by cmd.exe.
Detects scenarios where an attacker adds a reference in the registry to a malicious SSP (Security Support Provider). Note that this rule will not work with "in memory" SSP injection (Mimikatz).
Detects scenarios where a firewall rule is added using PowerShell or CMD.
Detects scenarios where an attacker attempts to disable Defender security service. If tamper protection is enabled, this action may not work.
Detects scenarios where an attacker update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.
Detects scenarios where an attacker enumerates domain group with tools like CME (--groups).
Detects scenarios where an attacker abuses the WinRS capacities for remote execution.
Detects scenarios where an attacker adds his account to a server role (sysadmin, securityadmin, serveradmin, ...)
Detects scenarios where an attacker modify the permissions of a service in order to abuse its privileges
Page 10 of 29