SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker will attempt to take control over a group policy.
Detects scenarios where an attacker attempt to hide emails in order to perform phishing attacks by replacing, for example, financial information from the original email with another email containing attacker's financial information. This technique may also be used to avoid specific email notification to be received by end users in case, for example, of an ongoing breach.
Detects scenarios where an attacker enumerates different remote WinRM listeners for lateral movement purposes.
Detects scenarios where an attacker enable the xp_cmdshell in order to execute non SQL content and escalate privileges
Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.
Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy.
Detects scenarios where an attacker creates a scheduled task via commmand line.
Detects scenarios where an attacker attempts to enable the Image File Execution Options (IFEO) debugger for sethc.
Detects scenarios where an attacker deployed an encoded PowerShell payload via a process execution. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.
Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
Page 16 of 29