SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence.
This rule detects activity related to 'SMOKEDHAM backdoor' which manipulate the default running service accounf of the MSDTC service in order to DLL side-load a malicious binary.
Detects scenarios where an attacker enumerates scheduled task configuration.
Detects scenarios where an attacker modifies registry permissions on a local or remote target in order to introduce a backdoor and dump hashes and credentials.
Detects scenarios where attack attempts to elevate privileges via customize Runas tool.
Detects scenarios where an attacker attempts to delete existing Windows native backup by reducing the allocated backup storage.
Detects scenarios where an attacker exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi
Detects scenarios where an attacker attempts to enable DNS over TLS in order to evade detection for command and control purposes.
Detects scenarios where an attacker attempts to connect to a Windows host using the SSH protocol.
Detects scenarios where an attacker attempts to modify the type of symbolic link than can be created.
Page 14 of 29