SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker would abuse some privileges while realying host credentials to escalate privileges.
Detects scenarios where an attacker abuse Kerberos constrained delegation in order to escalate privileges.
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker execute Secretdump in order to remotely dump credentials over SMB.
Detects scenarios where an attacker attempts to abuse certutil command to download obfuscated malicious payload using the Tchopper tool.
Detects scenarios where an attacker set an account with password not required to perform privilege escalation attack.
Detects scenarios where an attacker removes security protection from a sensitive account to escalate privileges
Detects scenarios where an attacker abuse MachineAccountQuota privilege and pre-create a computer object for abusing RBCD delegation.
Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller.
Detects scenarios where an attacker inject a payload into SQL Server in order to obtain a remote shell.
Page 7 of 29