sigma-rules

credential_access_access_to_browser_credentials_procargs.toml

[Rule Tuning] Access of Stored Browser Credentials (#2098 )

2022-07-22 17:58:53 +00:00

credential_access_credentials_keychains.toml

[Rule Tuning] Access to Keychain Credentials Directories (#2101 )

2022-07-22 18:15:16 +00:00

credential_access_dumping_hashes_bi_cmds.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

credential_access_dumping_keychain_security.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

credential_access_kerberosdump_kcc.toml

[Rule Tuning] Kerberos Cached Credentials Dumping (#2103 )

2022-07-22 18:20:06 +00:00

credential_access_keychain_pwd_retrieval_security_cmd.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

credential_access_mitm_localhost_webproxy.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

credential_access_potential_ssh_bruteforce.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

credential_access_promt_for_pwd_via_osascript.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

credential_access_systemkey_dumping.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

defense_evasion_apple_softupdates_modification.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

defense_evasion_attempt_del_quarantine_attrib.toml

[Rule Tuning] Remove File Quarantine Attribute (#2129 )

2022-07-22 20:26:08 +00:00

defense_evasion_attempt_to_disable_gatekeeper.toml

Review & Fix Invalid References (#1936 )

2022-04-26 20:59:20 +00:00

defense_evasion_install_root_certificate.toml

filter Bitdefender FPs (#2109 )

2022-07-25 14:13:36 +00:00

defense_evasion_modify_environment_launchctl.toml

[Rule Tuning] Modification of Environment Variable via Launchctl (#2119 )

2022-07-22 20:04:54 +00:00

defense_evasion_privacy_controls_tcc_database_modification.toml

[Rule Tuning] Potential Privacy Control Bypass via TCCDB Modification (#2121 )

2022-07-22 20:08:50 +00:00

defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

defense_evasion_safari_config_change.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

defense_evasion_sandboxed_office_app_suspicious_zip_file.toml

[Rule Tuning] Potential Microsoft Office Sandbox Evasion (#2123 )

2022-07-27 15:59:43 +00:00

defense_evasion_tcc_bypass_mounted_apfs_access.toml

add CVE to tag (#2127 )

2022-07-23 00:45:21 +00:00

defense_evasion_unload_endpointsecurity_kext.toml

[Rule Tuning] Attempt to Unload Elastic Endpoint Security Kernel Extension (#2134 )

2022-07-23 15:23:38 +00:00

discovery_users_domain_built_in_commands.toml

[Rule Tuning] Enumeration of Users or Groups via Built-in Commands (#2136 )

2022-07-22 20:17:30 +00:00

execution_defense_evasion_electron_app_childproc_node_js.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

execution_initial_access_suspicious_browser_childproc.toml

[Rule Tuning] Suspicious Browser Child Process (#2138 )

2022-08-23 13:57:23 +00:00

execution_installer_package_spawned_network_event.toml

[Rule Tuning] Standardizing Risk Score according to Severity (#2242 )

2022-08-22 01:30:44 +00:00

execution_script_via_automator_workflows.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

execution_scripting_osascript_exec_followed_by_netcon.toml

[Rule Tuning] Suspicious Automator Workflows Execution (#2142 )

2022-07-22 20:51:44 +00:00

execution_shell_execution_via_apple_scripting.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

initial_access_suspicious_mac_ms_office_child_process.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

lateral_movement_credential_access_kerberos_bifrostconsole.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

lateral_movement_mounting_smb_share.toml

exclude google drive FP (#2145 )

2022-07-22 21:01:10 +00:00

lateral_movement_remote_ssh_login_enabled.toml

[Rule Tuning] Remote SSH Login Enabled via systemsetup Command (#2147 )

2022-07-22 21:11:14 +00:00

lateral_movement_vpn_connection_attempt.toml

update description (#2149 )

2022-07-22 21:13:40 +00:00

persistence_account_creation_hide_at_logon.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

persistence_creation_change_launch_agents_file.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

persistence_creation_hidden_login_item_osascript.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

persistence_creation_modif_launch_deamon_sequence.toml

[Rule Tuning] LaunchDaemon Creation or Modification and Immediate Loading (#2154 )

2022-07-27 12:26:06 +00:00

persistence_credential_access_authorization_plugin_creation.toml

[Rule Tuning] Authorization Plugin Modification (#2156 )

2022-07-27 12:35:20 +00:00

persistence_crontab_creation.toml

Detection of suspicious crontab creation or modification (#1938 )

2022-04-27 06:40:40 +00:00

persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

persistence_directory_services_plugins_modification.toml

fix typo in description (#2168 )

2022-07-27 12:52:56 +00:00

persistence_docker_shortcuts_plist_modification.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

persistence_emond_rules_file_creation.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

persistence_emond_rules_process_execution.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

persistence_enable_root_account.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

persistence_evasion_hidden_launch_agent_deamon_creation.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

persistence_finder_sync_plugin_pluginkit.toml

[Rule Tuning] Finder Sync Plugin Registered and Enabled (#2172 )

2022-08-23 14:00:45 +00:00

persistence_folder_action_scripts_runtime.toml

[Rule Tuning] Persistence via Folder Action Script (#2174 )

2022-08-05 18:37:02 +00:00

persistence_login_logout_hooks_defaults.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

persistence_loginwindow_plist_modification.toml

[Rule Tuning] Potential Persistence via Login Hook (#2177 )

2022-08-05 18:26:31 +00:00

persistence_modification_sublime_app_plugin_or_script.toml

[Rule Tuning] Sublime Plugin or Application Script Modification (#2180 )

2022-08-05 18:16:34 +00:00

persistence_periodic_tasks_file_mdofiy.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

persistence_screensaver_engine_unexpected_child_process.toml

[Rule Tuning] Unexpected Child Process of macOS Screensaver Engine (#2184 )

2022-07-27 18:50:26 +00:00

persistence_screensaver_plist_file_modification.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

persistence_suspicious_calendar_modification.toml

[Rule Tuning] Suspicious Calendar File Modification (#2187 )

2022-08-02 18:08:24 +00:00

persistence_via_atom_init_file_modification.toml

[Rule Tuning] Missing MITRE ATT&CK Mappings (#2073 )

2022-07-22 18:31:42 +00:00

privilege_escalation_applescript_with_admin_privs.toml

2058 add setup field to metadata (#2061 )

2022-07-18 21:25:32 +00:00

privilege_escalation_explicit_creds_via_scripting.toml

[Rule Tuning] Execution with Explicit Credentials via Scripting (#2190 )

2022-08-02 18:21:59 +00:00

privilege_escalation_exploit_adobe_acrobat_updater.toml

[Rule Tuning] Suspicious Child Process of Adobe Acrobat Reader Update Service (#2192 )

2022-08-23 14:11:46 +00:00

privilege_escalation_local_user_added_to_admin.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00

privilege_escalation_root_crontab_filemod.toml

Linux Shell Evasion Rule Tuning (#1878 )

2022-03-29 21:03:35 -04:00