security — logsource-service tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• A Member Was Added to a Security-Enabled Global Group · sigma-rule
• A Member Was Removed From a Security-Enabled Global Group · sigma-rule
• A New Trust Was Created To A Domain · sigma-rule
• A Security-Enabled Global Group Was Deleted · sigma-rule
• Access To ADMIN$ Network Share · sigma-rule
• Account Tampering - Suspicious Failed Logon Reasons · sigma-rule
• Active Directory Replication from Non Machine Account · sigma-rule
• Active Directory User Backdoors · sigma-rule
• AD Object WriteDAC Access · sigma-rule
• AD Privileged Users or Groups Reconnaissance · sigma-rule
• Add or Remove Computer from DC · sigma-rule
• Addition of SID History to Active Directory Object · sigma-rule
• Admin User Remote Logon · sigma-rule
• Azure AD Health Monitoring Agent Registry Keys Access · sigma-rule
• Azure AD Health Service Agents Registry Keys Access · sigma-rule
• CobaltStrike Service Installations - Security · sigma-rule
• Credential Dumping Tools Service Execution - Security · sigma-rule
• DCERPC SMB Spoolss Named Pipe · sigma-rule
• DCOM InternetExplorer.Application Iertutil DLL Hijack - Security · sigma-rule
• Denied Access To Remote Desktop · sigma-rule
• Device Installation Blocked · sigma-rule
• DPAPI Domain Backup Key Extraction · sigma-rule
• DPAPI Domain Master Key Backup Attempt · sigma-rule
• Enabled User Right in AD to Control User Objects · sigma-rule
• ETW Logging Disabled In .NET Processes - Registry · sigma-rule
• External Disk Drive Or USB Storage Device Was Recognized By The System · sigma-rule
• External Remote RDP Logon from Public IP · sigma-rule
• External Remote SMB Logon from Public IP · sigma-rule
• Failed Code Integrity Checks · sigma-rule
• Failed Logon From Public IP · sigma-rule
• File Access Of Signal Desktop Sensitive Data · sigma-rule
• First Time Seen Remote Named Pipe · sigma-rule
• Group Policy Abuse for Privilege Addition · sigma-rule
• HackTool - EDRSilencer Execution - Filter Added · sigma-rule
• HackTool - NoFilter Execution · sigma-rule
• Hacktool Ruler · sigma-rule
• Hidden Local User Creation · sigma-rule
• HybridConnectionManager Service Installation · sigma-rule
• Impacket PsExec Execution · sigma-rule
• Important Scheduled Task Deleted/Disabled · sigma-rule
• Important Windows Event Auditing Disabled · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher - Security · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - Security · sigma-rule
• Invoke-Obfuscation Obfuscated IEX Invocation - Security · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - Security · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher - Security · sigma-rule
• Invoke-Obfuscation VAR+ Launcher - Security · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security · sigma-rule
• Invoke-Obfuscation Via Stdin - Security · sigma-rule
• Invoke-Obfuscation Via Use Clip - Security · sigma-rule
• Invoke-Obfuscation Via Use MSHTA - Security · sigma-rule
• Invoke-Obfuscation Via Use Rundll32 - Security · sigma-rule
• ISO Image Mounted · sigma-rule
• Kerberoasting Activity - Initial Query · sigma-rule
• Kerberos Manipulation · sigma-rule
• Local User Creation · sigma-rule
• LSASS Access From Non System Account · sigma-rule
• Metasploit Or Impacket Service Installation Via SMB PsExec · sigma-rule
• Metasploit SMB Authentication · sigma-rule
• Meterpreter or Cobalt Strike Getsystem Service Installation - Security · sigma-rule
• Mimikatz DC Sync · sigma-rule
• NetNTLM Downgrade Attack · sigma-rule
• New or Renamed User Account with '$' Character · sigma-rule
• Outgoing Logon with New Credentials · sigma-rule
• Pass the Hash Activity 2 · sigma-rule
• Password Change on Directory Service Restore Mode (DSRM) Account · sigma-rule
• Password Dumper Activity on LSASS · sigma-rule
• Password Policy Enumerated · sigma-rule
• Password Protected ZIP File Opened · sigma-rule
• Password Protected ZIP File Opened (Email Attachment) · sigma-rule
• Password Protected ZIP File Opened (Suspicious Filenames) · sigma-rule
• Persistence and Execution at Scale via GPO Scheduled Task · sigma-rule
• PetitPotam Suspicious Kerberos TGT Request · sigma-rule
• Possible DC Shadow Attack · sigma-rule
• Possible Impacket SecretDump Remote Activity · sigma-rule
• Possible PetitPotam Coerce Authentication Attempt · sigma-rule
• Possible Shadow Credentials Added · sigma-rule
• Potential Access Token Abuse · sigma-rule
• Potential AD User Enumeration From Non-Machine Account · sigma-rule
• Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation · sigma-rule
• Potential Privilege Escalation via Local Kerberos Relay over LDAP · sigma-rule
• Potential Privileged System Service Operation - SeLoadDriverPrivilege · sigma-rule
• Potential Secure Deletion with SDelete · sigma-rule
• Potentially Suspicious AccessMask Requested From LSASS · sigma-rule
• PowerShell Scripts Installed as Services - Security · sigma-rule
• Powerview Add-DomainObjectAcl DCSync AD Extend Right · sigma-rule
• Processes Accessing the Microphone and Webcam · sigma-rule
• Protected Storage Service Access · sigma-rule
• RDP Login from Localhost · sigma-rule
• RDP over Reverse SSH Tunnel WFP · sigma-rule
• Reconnaissance Activity · sigma-rule
• Register new Logon Process by Rubeus · sigma-rule
• Remote Access Tool Services Have Been Installed - Security · sigma-rule
• Remote PowerShell Sessions Network Connections (WinRM) · sigma-rule
• Remote Service Activity via SVCCTL Named Pipe · sigma-rule
• Remote Task Creation via ATSVC Named Pipe · sigma-rule
• Replay Attack Detected · sigma-rule
• RottenPotato Like Attack Pattern · sigma-rule
• SAM Registry Hive Handle Request · sigma-rule
• SCM Database Handle Failure · sigma-rule
• SCM Database Privileged Operation · sigma-rule
• Security Eventlog Cleared · sigma-rule
• Service Installed By Unusual Client - Security · sigma-rule
• Service Registry Key Read Access Request · sigma-rule
• SMB Create Remote File Admin Share · sigma-rule
• Startup/Logon Script Added to Group Policy Object · sigma-rule
• Successful Account Login Via WMI · sigma-rule
• Successful Overpass the Hash Attempt · sigma-rule
• Suspicious Access to Sensitive File Extensions · sigma-rule
• Suspicious Kerberos RC4 Ticket Encryption · sigma-rule
• Suspicious LDAP-Attributes Used · sigma-rule
• Suspicious PsExec Execution · sigma-rule
• Suspicious Remote Logon with Explicit Credentials · sigma-rule
• Suspicious Scheduled Task Creation · sigma-rule
• Suspicious Scheduled Task Update · sigma-rule
• Suspicious Teams Application Related ObjectAcess Event · sigma-rule
• Suspicious Windows ANONYMOUS LOGON Local Account Created · sigma-rule
• SysKey Registry Keys Access · sigma-rule
• Sysmon Channel Reference Deletion · sigma-rule
• T1047 Wmiprvse Wbemcomn DLL Hijack · sigma-rule
• Tap Driver Installation - Security · sigma-rule
• Transferring Files with Credential Data via Network Shares · sigma-rule
• Unauthorized System Time Modification · sigma-rule
• Uncommon Outbound Kerberos Connection - Security · sigma-rule
• User Added to Local Administrator Group · sigma-rule
• User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' · sigma-rule
• User Logoff Event · sigma-rule
• VSSAudit Security Event Source Registration · sigma-rule
• WCE wceaux.dll Access · sigma-rule
• Weak Encryption Enabled and Kerberoast · sigma-rule
• Win Susp Computer Name Containing Samtheadmin · sigma-rule
• Windows Default Domain GPO Modification · sigma-rule
• Windows Defender Exclusion List Modified · sigma-rule
• Windows Defender Exclusion Registry Key - Write Access Requested · sigma-rule
• Windows Event Auditing Disabled · sigma-rule
• Windows Filtering Platform Blocked Connection From EDR Agent Binary · sigma-rule
• Windows Network Access Suspicious desktop.ini Action · sigma-rule
• Windows Pcap Drivers · sigma-rule
• WMI Persistence - Security · sigma-rule