SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker attempts to create a symbolic link.
Detects scenarios where an attacker
Detects scenarios where an attacker adds its account into a sensitive Exchange group to obtain "Replicating Directory Changes /all" and perform DCsync attack.
Detects scenarios where an attacker enable or reconfigure BitLocker on multiple hosts for ransomware purposes.
Detects scenarios where an attacker having compromised a virtual machine via serial cable attempts to enumerate local groups.
Detects scenarios where a suspicious group membership is changed. Having Microsoft LAPS installed may trigger false positive events for the builtin administrators group triggered by the system account (S-1-5-18).
Detects scenarios where an attacker attempts to create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.
Detects if the eBPF sensor of Defender for Endpoint (Linux) is deactivated to evade detections.
Detects scenarios where an attacker attempts authenticate to the database using a disabled user accont
Detects scenarios where an attacker uses the Tchopper tool by remotely creating multiple services via named pipes.
Page 13 of 29