SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker modifies the registry configuration in order to enable or downgrade NTLM protocol version, to later on perform relay attacks.
Detects scenarios where an attacker attempt to dump Azure Active Directory Connect credentials via network share.
Detects scenarios where an attacker execute a remote shell via the admin share.
Detects scenarios where an attacker will dump the LSASS memory content using tools like Mimikatz, ProcDump, TaskMgr, ...
Detects scenarios where an attacker attempt to dump browser credentials (Firefox, Google Chrome, ...) via network share.
Detects scenarios where an attacker abuse Kerberos unconstrained delegation for domain persistence.
Detects scenarios where an attacker modify the permissions of a service in order to abuse its privileges
Detects scenarios where a default Windows host name pattern (WIN-...) is detected during a login attempt. Having a host with a default name may be an indicator of a fresh machine deployed by an attacker to evade detection and perform malicious activities.
Detects scenarios where an attacker would attempt to enumerate hosts resources and execute a payload with a compromised account. Vulnerability scanners, enumeration software or tool like SharepHound/CrackMapexec may generate such behavior.
Detects scenarios where an attacker abuse RPC, NTLM relay and others components to escalate privileges.
Page 4 of 29