SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,582 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker creates a privileged task to establish persistence.
Detects scenarios where an attacker attempts to create a service that triggers TSCON in order to preform local RDP session hijack.
Detects scenarios where an attacker would attempt to alter or disable OCSP responder auditing settings to evade detection and perform further escalation via ADCS vulnerabilities.
Detects scenarios where an attacker attempts to connect to the administrative SMB share.
Detects scenarios where an attacker attempts to enable Wdgiest authention so passwords are stored in clear text and can be dumped.
Detects scenarios where an attacker attempts to execute WMIexec in order to escalate privileges.
Detects scenarios where an attacker enables a disabled builtin account.
Detects scenarios where an attacker is attempting to discover sensitive accounts using tools like Bloodhound. To find out the source of the enumeration, correlate the SubjectLogonId from ID 4662 with TargetLogonId from ID 4624.
Detects scenarios where an attacker changes permissions on the AdminSDHolder container to establish persistence.
Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
Page 8 of 29