SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker modify the original service executable path with a malicious one.
Detects scenarios where an attacker attempts to escalate privileges while abusing KrbRelayUp attack.
Detects scenarios where an attacker would attempt to escalate privileges by changing the security settings of the responder.
Detects Blacklotus HTTP downloader injection into winlogon.exe process.
Detects scenarios where an attacker attempt to dump user profile information via network share.
Detects scenarios where an attacker attempts to enumerate local users via commandline.
Detects scenarios where an attacker modifies network share permissions in order to facilitate lateral movement and avoid detection by creating new network shares
Detects scenarios where an attacker attempts to enumerate or to establish a connection to a network share.
Detects scenarios where an attacker attempts to dump the LSASS process content using a renamed version of the Procdump tool.
Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. With this command, attacker appends the current service name to a file.
Page 22 of 29