SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
Detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities
Detects scenarios where an attacker configures BitLocker for ransomware purposes.
Detects scenarios where an attacker set an account with reversible encryption to facilitate brutforce or cracking operations.
Detects scenarios where an attacker set an account with DES Kerberos encryption to perform ticket brutforce.
Detects scenarios where an account password is set to never expire.
Detects scenarios where an attacker creates a user account that fakes a computer account.
NetSYnc attack
Sigma
NetSync allows an attacker to take the NTLM hash of a Domain Controller (DC) machine account ("usually" identified by ending in "$") and using it to obtain the NTLM machine account hash of another machine account through impersonation (similar to, but different from, DCSync). Where DCSync can obtain user account passwords, NetSync is limited to machine accounts. The other main differentiator between DCSync and NetSync is that DCSync will make use of Microsoft's Directory Replication Service (DRS) Remote Protocol, whereas NetSync uses the older Netlogon Remote Protocol (MS-NRPC)
Detects scenarios where an attacker attempts to enumerate domain local groups with tools like CME (--local-groups).
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Page 21 of 29