SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.
Detects scenarios where an attacker configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.
Detects scenarios where a firewall rule any/any is added to allow any incoming or outgoing traffic.
Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
Detects scenarios where Defender signatures are outdated.
Detects scenarios where an attacker perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
Detects scenarios where an attacker grants replication privilege to an account to exflitrate Active Directory credentials
Detects scenarios where an attacker adds his account to a database role (db_securityadmin, db_datawriter, db_securityadmin, ...)
Detects scenarios where an attacker starts SQL Server service in single mode to perform password recovery actions using, for example, the native sqlcmd tool. Indeed, when the SQL Server is started in single user mode, all the users who are a member of the host’s local administrator group can connect to the SQL instance.
Detects scenarios where an attacker remotely creates a scheduled task on multiple hosts over named pipes to execute commands or elevate privileges.
Page 19 of 29