SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
Detects scenarios where an attacker enumerates different remote WinRM listeners for lateral movement purposes.
Detects scenarios where an attacker enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.
Detects scenarios where an attacker attempts to disable
Detects scenarios where an attacker modify the configuration of a service to trigger an action when the service is crashed.
Detects scenarios where an attacker modify the configuration of a service to trigger an action when the service is crashed.
Detects scenarios where an attacker enable the Eaphost component in order to perform a DLL sideloading attack.
Detects scenarios where an attacker abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.
Detects scenarios where an attacker remotely creates a scheduled task over named pipes to execute commands or elevate privileges.
Detects scenarios where an attacker abuse task scheduler capacities to execute commands or elevate privileges.
Page 25 of 29