SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.
Detects scenarios where an attacker abuse the SeMachineAccountPrivilege which allows per default any authenticated user to join a computer to the domain. Later on, this computer account can be manipulated in order to elevate privileges.
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker use the native Windows sniffer in order to capture sensitive information or credentials.
Detects scenarios where an attacker with a responder in place initiates an authenticated callback request from a targeted host with the print spooler service enabled (RpcRemoteFindFirstPrinterChangeNotification abuse). In case the targeted host answers to the responder, the NTLM hash of the computer account will be disclosed. Following that, the hash can be used for different type of abuse like Silver ticket generation or unconstrained delegation abuse. The rule is designed to detect the following scripts > printerbug.py, dementor.py, SpoolSample.exe and Get-SpoolStatus.ps1.
Detects scenarios where an attacker creates a computer account with privileges for later exploitation.
Detects scenarios where an attacker changed the IFEO settings related to sethc.
Detects scenarios where an attacker loads a malicious SSP (Security Support Provider) into the LSA process. Note that this rule will not work with "in memory" SSP injection (Mimikatz) as no event will be triggered.
Detects scenarios where an attacker attempts to request a proxiable ticket. This action may trigger while attempting to identify a vulnerable target or using some offsensive Kerberos tools like Kerbrute, Impacket...
Detects scenarios where a suspicious password reset of the Krbtgt account is performed by attacker to issue a potential Golden ticket.
Page 3 of 29