SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker use DCSync or SecretDump tool to exfiltrate Active Directory credentials
Detects scenarios where an attacker attempts to enumerate the domain password policy with native commands or tools like CME (--pass-pol).
Detects scenarios where an attacker would dump user passwords using the DCshadow attack.
Detects scenarios where an attacker attempts to create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.
Detects scenarios where an attacker tries to move laterally using RDP and access attempt is blocked due to restricted logon policies.
Detects data exfiltration performed by the Vice Society ransomware gang using a custom built PowerShell script. More precisely, the script enumerates the volumes mounted on the system, then starts crawling the different directories before initiating the data exfiltration over HTTP by creating multiple different jobs. As PowerShell script block logs the script execution into multiple events, the detection aggregates the different log chunks using the ScriptBlockId and then ensure that at least 3 of the 4 detection strings are found.
Detects scenarios where an attacker attempts to delete existing Windows native backup (only available on Windows Server).
Detects scenarios where an attacker attempts to remotely execute WMIexec via SMB admin share in order to escalate privileges.
Detects scenarios where an attacker installs and executes PSexec.
Detects scenarios where an attacker installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.
Page 12 of 29