1200KM / tag
attack.collection — sigma-tag tag
108 related reference pages for sigma-tag: attack.collection.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- 7Zip Compressing Dump Files · sigma-rule
- ADFS Database Named Pipe Connection By Uncommon Tool · sigma-rule
- Attempts of Kerberos Coercion Via DNS SPN Spoofing · sigma-rule
- Audio Capture · sigma-rule
- Audio Capture via PowerShell · sigma-rule
- Audio Capture via SoundRecorder · sigma-rule
- Automated Collection Command PowerShell · sigma-rule
- Automated Collection Command Prompt · sigma-rule
- AWS EC2 VM Export Failure · sigma-rule
- Bitbucket Full Data Export Triggered · sigma-rule
- Bitbucket Unauthorized Full Data Export Triggered · sigma-rule
- Bitbucket User Details Export Attempt Detected · sigma-rule
- Bitbucket User Permissions Export Attempt · sigma-rule
- Browser Started with Remote Debugging · sigma-rule
- Cisco BGP Authentication Failures · sigma-rule
- Cisco Collect Data · sigma-rule
- Cisco LDP Authentication Failures · sigma-rule
- Cisco Stage Data · sigma-rule
- Clipboard Access Via OSAScript · sigma-rule
- Clipboard Collection of Image Data with Xclip Tool · sigma-rule
- Clipboard Collection with Xclip Tool · sigma-rule
- Clipboard Collection with Xclip Tool - Auditd · sigma-rule
- Compress Data and Lock With Password for Exfiltration With 7-ZIP · sigma-rule
- Compress Data and Lock With Password for Exfiltration With WINZIP · sigma-rule
- Compressed File Creation Via Tar.EXE · sigma-rule
- Compressed File Extraction Via Tar.EXE · sigma-rule
- Copy From Or To Admin Share Or Sysvol Folder · sigma-rule
- Crash Dump Created By Operating System · sigma-rule
- CredUI.DLL Loaded By Uncommon Process · sigma-rule
- Data Compressed · sigma-rule
- Data Copied To Clipboard Via Clip.EXE · sigma-rule
- Disk Image Mounting Via Hdiutil - MacOS · sigma-rule
- DNS Query Request To OneLaunch Update Service · sigma-rule
- Esentutl Steals Browser Information · sigma-rule
- Exchange PowerShell Snap-Ins Usage · sigma-rule
- Files Added To An Archive Using Rar.EXE · sigma-rule
- Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet · sigma-rule
- Github Delete Action Invoked · sigma-rule
- Github Outside Collaborator Detected · sigma-rule
- GitHub Repository Pages Site Changed to Public · sigma-rule
- Github Self Hosted Runner Changes Detected · sigma-rule
- Google Full Network Traffic Packet Capture · sigma-rule
- Google Workspace Out Of Domain Email Forwarding · sigma-rule
- GUI Input Capture - macOS · sigma-rule
- HackTool - ADCSPwn Execution · sigma-rule
- HackTool - Impacket Tools Execution · sigma-rule
- Hacktool Ruler · sigma-rule
- Huawei BGP Authentication Failures · sigma-rule
- ISATAP Router Address Was Set · sigma-rule
- Juniper BGP Missing MD5 · sigma-rule
- Linux Keylogging with Pam.d · sigma-rule
- Local Privilege Escalation Indicator TabTip · sigma-rule
- Notepad++ Updater DNS Query to Uncommon Domains · sigma-rule
- OpenCanary - GIT Clone Request · sigma-rule
- OpenCanary - MSSQL Login Attempt Via SQLAuth · sigma-rule
- OpenCanary - MSSQL Login Attempt Via Windows Authentication · sigma-rule
- OpenCanary - MySQL Login Attempt · sigma-rule
- OpenCanary - REDIS Action Command Attempt · sigma-rule
- OpenCanary - SIP Request · sigma-rule
- OpenCanary - SMB File Open Request · sigma-rule
- Periodic Backup For System Registry Hives Enabled · sigma-rule
- Potential Data Stealing Via Chromium Headless Debugging · sigma-rule
- Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation · sigma-rule
- Potential Keylogger Activity · sigma-rule
- Potential PetitPotam Attack Via EFS RPC Calls · sigma-rule
- Potential SMB Relay Attack Tool Execution · sigma-rule
- Potential Suspicious Activity Using SeCEdit · sigma-rule
- PowerShell Get Clipboard · sigma-rule
- PowerShell Get-Clipboard Cmdlet Via CLI · sigma-rule
- Powershell Keylogging · sigma-rule
- Powershell Local Email Collection · sigma-rule
- Processes Accessing the Microphone and Webcam · sigma-rule
- PST Export Alert Using eDiscovery Alert · sigma-rule
- PST Export Alert Using New-ComplianceSearchAction · sigma-rule
- PUA - Mouse Lock Execution · sigma-rule
- Rar Usage with Password and Compression Level · sigma-rule
- Recon Information for Export with Command Prompt · sigma-rule
- Recon Information for Export with PowerShell · sigma-rule
- RottenPotato Like Attack Pattern · sigma-rule
- Screen Capture - macOS · sigma-rule
- Screen Capture Activity Via Psr.EXE · sigma-rule
- Screen Capture with Import Tool · sigma-rule
- Screen Capture with Xwd · sigma-rule
- Script Interpreter Spawning Credential Scanner - Linux · sigma-rule
- Script Interpreter Spawning Credential Scanner - Windows · sigma-rule
- SQLite Chromium Profile Data DB Access · sigma-rule
- SQLite Firefox Profile Data DB Access · sigma-rule
- Suspicious Access to Sensitive File Extensions · sigma-rule
- Suspicious Camera and Microphone Access · sigma-rule
- Suspicious Child Process of Notepad++ Updater - GUP.Exe · sigma-rule
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing · sigma-rule
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network · sigma-rule
- Suspicious Inbox Forwarding Identity Protection · sigma-rule
- Suspicious Manipulation Of Default Accounts Via Net.EXE · sigma-rule
- Suspicious Network Communication With IPFS · sigma-rule
- Uncommon File Created by Notepad++ Updater Gup.EXE · sigma-rule
- Veeam Backup Database Suspicious Query · sigma-rule
- VeeamBackup Database Credentials Dump Via Sqlcmd.EXE · sigma-rule
- WinDivert Driver Load · sigma-rule
- Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted · sigma-rule
- Windows Recall Feature Enabled - Registry · sigma-rule
- Windows Recall Feature Enabled Via Reg.EXE · sigma-rule
- Windows Screen Capture with CopyFromScreen · sigma-rule
- Winrar Compressing Dump Files · sigma-rule
- WinRAR Execution in Non-Standard Folder · sigma-rule
- Zip A Folder With PowerShell For Staging In Temp - PowerShell Module · sigma-rule
- Zip A Folder With PowerShell For Staging In Temp - PowerShell · sigma-rule
- Zip A Folder With PowerShell For Staging In Temp - PowerShell Script · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.