SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker attempts to clear the event logs.
Detects scenarios where an attacker cleared the event logs.
Detects scenarios where an attacker attempts to abuse certutil command to download obfuscated malicious payload.
Detects scenarios where an attacker attempts enumerate the audit policy in place.
Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.
Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.
Provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.
Detects scenarios where an attacker attempts to edit IIS configuration file in order to load a module.
Detects scenarios where a new member is added to a sensitive group related to Exchange server
Detects scenarios where an attacker relays Exchange server authentication to abuse Exchange servers permissions and escalate privileges.
Page 23 of 29