sigma-rules

command_and_control_via_network_connections_with_low_occurrence_frequency_for_unique_agents.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

command_and_control_via_unusual_file_downloads_from_source_addresses.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

defense_evasion_via_capitalized_process_execution.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

defense_evasion_via_hidden_process_execution.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

defense_evasion_via_multi_dot_process_execution.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

excessive_ssh_network_activity_unique_destinations.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

execution_uncommon_process_execution_from_suspicious_directory.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

login_activity_by_source_address.md

[Hunt Tuning] Logon Activity by Source IP (#4428 )

2025-01-31 15:44:38 +01:00

low_volume_external_network_connections_from_process.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

low_volume_gtfobins_external_network_connections.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

low_volume_modifications_to_critical_system_binaries.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

low_volume_process_injection_syscalls_by_executable.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_general_kernel_manipulation.md

[New Hunt] General Kernel Manipulation (#4403 )

2025-02-05 16:18:51 +01:00

persistence_reverse_bind_shells.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_cron.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_desktop_bus.md

[New Hunt] Persistence via Desktop Bus (D-Bus) (#4407 )

2025-02-05 16:45:17 +01:00

persistence_via_driver_load_with_low_occurrence_frequency.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_dynamic_linker_hijacking.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_git_hook_pager.md

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

persistence_via_grub_bootloader.md

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

persistence_via_initramfs.md

[New Hunt] Persistence via Initramfs (#4402 )

2025-01-27 10:19:44 +01:00

persistence_via_loadable_kernel_modules.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_malicious_docker_container.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_message_of_the_day.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_network_manager_dispatcher_script.md

[New Hunt] Persistence via NetworkManager Dispatcher Script (#4408 )

2025-02-06 09:33:42 +01:00

persistence_via_package_manager.md

[Hunt Tuning] Logon Activity by Source IP (#4428 )

2025-01-31 15:44:38 +01:00

persistence_via_pluggable_authentication_module.md

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

persistence_via_policykit.md

[New Hunt] Persistence via PolicyKit (#4406 )

2025-02-05 16:29:47 +01:00

persistence_via_rc_local.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_rpm_dpkg_installer_packages.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_shell_modification_persistence.md

[Tuning & Changes] Misc rule/hunt tuning (#3875 )

2024-07-11 14:55:33 +02:00

persistence_via_ssh_configurations_and_keys.md

[Hunt Tuning] Persistence via SSH Configurations and/or Keys (#4351 )

2025-01-13 16:53:09 +01:00

persistence_via_systemd_timers.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_sysv_init.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_udev.md

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

persistence_via_unusual_system_binary_parent.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_user_group_creation_modification.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_web_shell.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_xdg_autostart_modifications.md

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

privilege_escalation_via_existing_sudoers.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

privilege_escalation_via_process_capabilities.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

privilege_escalation_via_segmentation_fault_and_buffer_overflow.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

privilege_escalation_via_suid_binaries.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00