SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker attempts to enumerate local or domain groups via commandline.
Detects scenarios where an attacker execute PSexec on a remote host via SMB
Detects scenarios where an attacker would perform share permission enumeration using CrackMaxExec SMBmodule.
Detects scenarios where an attacker attempts to delete existing VSS backup.
Detects scenarios where an attacker used a forged Golden ticket to login on a remote shared folder. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.
Detects scenarios where an attacker will attempt to take control over a group policy.
Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
Detects scenarios when a new file share is created.
Detects scenarios where an attacker would attempt to enumerate hosts and collect relevant information using anonymous access. Vulnerability scanners, enumeration software or tool like CrackMapexec may generate such behavior.
Page 5 of 29