joesecurity | Detection.FYI

sigma-rules

Nov 4, 2024 ·
Share on:

Read More

Recent Posts

Renamed Powershell Under Powershell Channel
Suspicious Non PowerShell WSMAN COM Provider
BITS Transfer Job With Uncommon Or Suspicious Remote TLD
CodeIntegrity - Unmet Signing Level Requirements By File Under Validation
Relevant Anti-Virus Signature Keywords In Application Log
Uncommon AppX Package Locations
Suspicious Windows Service Tampering
DNS Query To Remote Access Software Domain From Non-Browser App

Language

SIGMA 3900 ELASTIC 1240 MQL 497

Tags

ATTACK.DEFENSE-EVASION 1271 USE-CASE-THREAT-DETECTION 850 ATTACK.EXECUTION 829 DOMAIN-ENDPOINT 771 DATA-SOURCE-ELASTIC-DEFEND 619 ATTACK.PERSISTENCE 571 OS-WINDOWS 441 ATTACK.PRIVILEGE-ESCALATION 373 DATA-SOURCE-ELASTIC-ENDGAME 343 DETECTION.EMERGING-THREATS 330 TACTIC-DEFENSE-EVASION 307 ATTACK.CREDENTIAL-ACCESS 298 RESOURCES-INVESTIGATION-GUIDE 282 OS-LINUX 279