SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where a suspicious change is done on DNSadmin group in order to abuse DNSadmin privileges for DLL load.
Detects scenarios where a DLL is loaded by the DNS server in order to escalate privileges or initiate a remote shell.
Detects scenarios where an attacker attempts to disable Defender security features by modifying service configuration in registry.
Detects scenarios where an attacker tamper Defender RTP protection and disable it.
Detects if an attacker logs on using the serial console.
Detects if an attacker open a privileged CMD shell while accessing to an Azure virtual machine via serial cable.
Detects scenarios where an attacker update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.
Detects scenarios where an attacker adds a SPN to an account in order to perform different type of abuse (Kerberoast, delegation abuse, ...)
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Page 24 of 29