SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker dump the LSASS memory content using Mimikatz (sekurlsa module).
Detects scenarios where an attacker exploit the PrintNightmare vulnerability by exposing a vulnerable shared printer. At any case, any new printer share creation should be carefully monitored.
Detects scenarios where an attacker used a forged Golden ticket to login on a remote host. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.
Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller. Once the attack is done, attacker will rollback the sAMAccountName to its original name.
Detects scenarios where an attacker abuse an account with UAC settings set to "Accounts Does not Require Pre-Authentication" in order to perform offline TGT brutforce. May also be triggered by an attacker performing some Kerberos user enumration with tools like "Kerbrute".
Detects scenarios where a new member is added to a sensitive group related to Exchange server
Detects scenarios where an attacker modify the original service executable path with a malicious one.
Detects scenarios where attack attempts to elevate privileges via the command runas.
Detects scenarios where an federated trust is added by an attacker.
Detects scenarios where an attacker enables the disabled (recommended) SA admin account on the SQL Server instance.
Page 2 of 29