SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker attempts to move laterally by mounting a network share using compromised user credentials.
Detects scenarios where an attacker abuses the Windows "system failure and recovery" capacities (CrashControl) to store information or to establish persistence.
Detects scenarios where an attacker execute the Impacket DCOMexec tool in order to abuse DCOM services.
Detects scenarios where an attacker attempt to dump the LSASS process via the Task Manager.
Detects scenarios where an attacker attempt to dump LSASS process with tools like Mimikatz.
Detects scenarios where an attacker compromise a server with high privileges to perform permissions changes. PrivExchange attack can be detected using this rule.
Detects scenarios where a same threat is detected on different hosts in a short period of time
Detects scenarios where multiple suspicious threats are detected on a single host
Detects scenarios where an attacker updates the Service Principal Name (SPN) of a fake domain controller account in order to perform DCshadow attack.
Detects scenarios where an attacker grants new privileges on a database level
Page 17 of 29