| sigma |
Volume Shadow Copy Mount |
test |
2022-12-25 |
| sigma |
Enumeration for Credentials in Registry |
test |
2022-12-25 |
| sigma |
DHCP Server Error Failed Loading the CallOut DLL |
test |
2022-12-25 |
| sigma |
New DLL Added to AppInit_DLLs Registry Key |
test |
2022-12-25 |
| sigma |
Vulnerable Netlogon Secure Channel Connection Allowed |
test |
2022-12-25 |
| sigma |
NTFS Vulnerability Exploitation |
test |
2022-12-25 |
| sigma |
PowerShell Scripts Installed as Services |
test |
2022-12-25 |
| sigma |
Tap Driver Installation |
test |
2022-12-25 |
| sigma |
Potential COM Objects Download Cradles Usage - Process Creation |
test |
2022-12-25 |
| sigma |
Powershell Inline Execution From A File |
test |
2022-12-25 |
| sigma |
PowerShell Get-Clipboard Cmdlet Via CLI |
test |
2022-12-25 |
| sigma |
Execution via WorkFolders.exe |
test |
2022-12-25 |
| sigma |
Linux Crypto Mining Indicators |
test |
2022-12-25 |
| sigma |
PSExec and WMI Process Creations Block |
test |
2022-12-25 |
| sigma |
Google Cloud Kubernetes CronJob |
test |
2022-12-25 |
| sigma |
Account Lockout |
test |
2022-12-25 |
| sigma |
Possible Coin Miner CPU Priority Param |
test |
2022-12-25 |
| sigma |
Data Exfiltration with Wget |
test |
2022-12-25 |
| sigma |
OneLogin User Account Locked |
test |
2022-12-25 |
| sigma |
OneLogin User Assumed Another User |
test |
2022-12-25 |
| sigma |
Suspicious Computer Account Name Change CVE-2021-42287 |
test |
2022-12-25 |
| sigma |
Suspicious Tasklist Discovery Command |
test |
2022-12-25 |
| sigma |
CVE-2021-1675 Print Spooler Exploitation Filename Pattern |
test |
2022-12-25 |
| sigma |
CVE-2020-0688 Exploitation via Eventlog |
test |
2022-12-25 |
| sigma |
Compress Data and Lock With Password for Exfiltration With WINZIP |
test |
2022-12-25 |
| sigma |
Potential RDP Exploit CVE-2019-0708 |
test |
2022-12-25 |
| sigma |
Tasks Folder Evasion |
test |
2022-12-25 |
| sigma |
Execution via stordiag.exe |
test |
2022-12-25 |
| sigma |
Suspicious Splwow64 Without Params |
test |
2022-12-25 |
| sigma |
InstallerFileTakeOver LPE CVE-2021-41379 File Create Event |
test |
2022-12-25 |
| sigma |
Scanner PoC for CVE-2019-0708 RDP RCE Vuln |
test |
2022-12-25 |
| sigma |
WhoAmI as Parameter |
test |
2022-12-25 |
| sigma |
Login to Disabled Account |
test |
2022-12-25 |
| sigma |
User Access Blocked by Azure Conditional Access |
test |
2022-12-25 |
| sigma |
Google Cloud SQL Database Modified or Deleted |
test |
2022-12-25 |
| sigma |
Change to Authentication Method |
test |
2022-12-25 |
| sigma |
Linux Capabilities Discovery |
test |
2022-12-25 |
| sigma |
Linux Reverse Shell Indicator |
test |
2022-12-25 |
| sigma |
Loading of Kernel Module via Insmod |
test |
2022-12-25 |
| sigma |
Browser Started with Remote Debugging |
test |
2022-12-23 |