SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,573 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker uses RDP tunneling to redirect traffic to a C&C target.
Detects scenarios where an attacker has initiated a RDP shadow session.
Detects scenarios where an attacker attempt to dump application credentials (Firefox, VNC, Google Chrome, ...) via network share.
Detects scenarios where an attacker attempts to connect to the administrative SMB share.
Detects scenarios where an attacker attempts to modify the Hosts file to perform DNS interception and/or redirect network traffic.
Detects scenarios where an attacker attempts disbaled the audit policy for defense evasion purposes.
Detects scenarios where an attacker update the Service Principal Name (SPN) of a user account in order to enable Kerberoast attack and crack its password.
Detects scenarios where an attacker is using
Detects scenarios where an attacker is attempting to discover sensitive accounts using tools like Bloodhound. To find out the source of the enumeration, correlate the SubjectLogonId from ID 4662 with TargetLogonId from ID 4624.
Detects scenarios where an attacker enables CLR (Common Language Runtime with .NET) to abuse store procedures in order to move lateraly.
Page 9 of 29