SIGMA Detection Rules
@SIGMADetectionRules3 followers10,486 downloads91 copies0 likes3,582 views
281 detections
Filters
Last updated
All Time
Detection languages
281
Categories
89
11
6
4
4
Platforms
264
3
1
Products / Services
128
5
4
3
3
MITRE Techniques
109
99
85
46
43
Detects scenarios where an attacker grants new privileges on a SQL instance level
Detects scenarios where an attacker enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.
Detects scenarios where an attacker uses RDP tunneling to redirect traffic to a C&C target.
Detects scenarios where an attacker has initiated a RDP shadow session.
Detects scenarios where an attacker attempt to dump application credentials (Firefox, VNC, Google Chrome, ...) via network share.
Detects scenarios where an attacker attempts to modify the Hosts file to perform DNS interception and/or redirect network traffic.
Detects scenarios where an attacker attempts disbaled the audit policy for defense evasion purposes.
Detects scenarios where an attacker update the Service Principal Name (SPN) of a user account in order to enable Kerberoast attack and crack its password.
Detects scenarios where an attacker is using
Detects scenarios where an attacker enables CLR (Common Language Runtime with .NET) to abuse store procedures in order to move lateraly.
Page 9 of 29