SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker creates a hidden local account. See also rule "User account creation disguised in a computer account".
Detects scenarios where an attacker attempts to alter certificate chain validation by installing a root CA.
Detects scenarios where an attacker attempts to disbale or clear the audit policy for defense evasion purposes.
Detects scenarios where an attacker WMIimplant
Detects scenarios where APT actors exploits Fortinet vulnerabilities to gain access into Windows infrastructure.
Provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.
Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.
Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.
Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.
Detects scenarios where a DLL is loaded by the DNS server in order to escalate privileges or initiate a remote shell.
Page 27 of 29