SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
System time changed
Sigma
Detects scenarios where an attacker attempts to change the system time to evade defense. Check also if NewTime is different from PreviousTime to reduce false positives.
Detects scenarios where an attacker attempts to replace the original sethc.exe file by cmd.exe.
Detects scenarios where an attacker attempts to delete or resize existing VSS backup.
Detects scenarios where an attacker (specially Blackcat) increase the number of oufstanding requests to distribute malware payloads.
Detects scenarios where an attacker attempts to register a SIP or trust provider in order to mislead signature validation checks.
Detects scenarios where an attacker execute the Impacket DCOMexec tool in order to abuse DCOM services.
Detects scenarios where an attacker attempts to create a hard link.
Detects scenarios where an attacker disabled the Windows Firewall to evade defense.
Detects scenarios where an attacker downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.
Detects scenarios where an attacker set an account with Kerberos pre-authentication not required to perform offline brutforce. Account with this status can be checked with the following command > "Get-ADUser -Filter 'useraccountcontrol -band 4194304' -Properties useraccountcontrol".
Page 11 of 29