SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where a DLL is loaded by the DNS server in order to escalate privileges or initiate a remote shell.
Detects scenarios where an attacker attemptes to download a payload directly via console.
Detects scenarios where an attacker executes Chrome in headless mode in order to download a payload. Document Object Model (DOM) may also be abused to download obfuscated data from attacker repositary.
Detects scenarios where an attacker downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.
Detects scenarios where an attacker rename a non admin account in order to evade SOC & operations vigilance
Detects scenarios where a suspicious group membership is changed.
Detects scenarios where a suspicious group membership is changed.
Detects scenarios where an attacker compromise a server with high privileges to perform permissions changes. Note that a dedicated rule for Exchange exists.
Detects scenarios where an attacker attempts to enumerate sensitive domain group settings and membership.
Detects scenarios where an attacker attempts to forge a special Kerberos service ticket in order to extract credentials from Read Only Domain Controllers (RODC).
Page 28 of 29