SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker creates a privileged task to establish persistence.
Detects scenarios where an attacker attempts to create a service that triggers TSCON in order to preform local RDP session hijack.
Detects scenarios where an attacker would attempt to alter or disable OCSP responder auditing settings to evade detection and perform further escalation via ADCS vulnerabilities.
Detects scenarios where an attacker attempts to enable Wdgiest authention so passwords are stored in clear text and can be dumped.
Detects scenarios where an attacker attempts to execute WMIexec in order to escalate privileges.
Detects scenarios where an attacker enables a disabled builtin account.
Detects scenarios where an attacker changes permissions on the AdminSDHolder container to establish persistence.
Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
Detects scenarios where an attacker grants new privileges on a SQL instance level
Detects scenarios where an attacker enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.
Page 8 of 29