SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker attempts to kill multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
Help to detect scenarios where an attacker exploit the Mimispool print driver to escalate privileges.
Detects scenarios where an attacker grants new rights to an account in order to escalate privileges
Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
Detects scenarios where a user of a predefined set of group(s) logs on a target machine.
Detects scenarios where an attacker attempts to clear the event logs.
Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
Detects scenarios where an attacker attempts to create a firewall rule to allow unauthorized communications.
Detects scenarios where an attacker disabled the Windows Firewall to evade defense.
Detects scenarios where an attacker attempts to extract current Windows firewall configuration to prepare an attack.
Page 20 of 29