1200KM / tag
attack.command-and-control — sigma-tag tag
233 related reference pages for sigma-tag: attack.command-and-control.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Activity from Anonymous IP Addresses · sigma-rule
- Activity from Infrequent Country · sigma-rule
- Activity from Suspicious IP Addresses · sigma-rule
- ADSI-Cache File Creation By Uncommon Tool · sigma-rule
- Antivirus Exploitation Framework Detection · sigma-rule
- Anydesk Temporary Artefact · sigma-rule
- AppX Package Installation Attempts Via AppInstaller.EXE · sigma-rule
- APT User Agent · sigma-rule
- Arbitrary File Download Via GfxDownloadWrapper.EXE · sigma-rule
- Atera Agent Installation · sigma-rule
- Bitsadmin to Uncommon IP Server Address · sigma-rule
- Bitsadmin to Uncommon TLD · sigma-rule
- Browser Execution In Headless Mode · sigma-rule
- Change User Agents with WebRequest · sigma-rule
- Cisco Stage Data · sigma-rule
- Cloudflared Portable Execution · sigma-rule
- Cloudflared Quick Tunnel Execution · sigma-rule
- Cloudflared Tunnel Connections Cleanup · sigma-rule
- Cloudflared Tunnel Execution · sigma-rule
- Cloudflared Tunnels Related DNS Requests · sigma-rule
- Cobalt Strike DNS Beaconing · sigma-rule
- Command Line Execution with Suspicious URL and AppData Strings · sigma-rule
- Communication To LocaltoNet Tunneling Service Initiated · sigma-rule
- Communication To LocaltoNet Tunneling Service Initiated - Linux · sigma-rule
- Communication To Ngrok Tunneling Service - Linux · sigma-rule
- Communication To Ngrok Tunneling Service Initiated · sigma-rule
- Communication To Uncommon Destination Ports · sigma-rule
- Connection Proxy · sigma-rule
- Crypto Miner User Agent · sigma-rule
- Curl Download And Execute Combination · sigma-rule
- Curl Usage on Linux · sigma-rule
- DNS Exfiltration and Tunneling Tools Execution · sigma-rule
- DNS Query by Finger Utility · sigma-rule
- DNS Query Request By QuickAssist.EXE · sigma-rule
- DNS Query To AzureWebsites.NET By Non-Browser Process · sigma-rule
- DNS Query To Common Malware Hosting and Shortener Services · sigma-rule
- DNS Query To Devtunnels Domain · sigma-rule
- DNS Query To Remote Access Software Domain From Non-Browser App · sigma-rule
- DNS Query To Visual Studio Code Tunnels Domain · sigma-rule
- DNS Query Tor .Onion Address - Sysmon · sigma-rule
- DNS TXT Answer with Possible Execution Strings · sigma-rule
- Download File To Potentially Suspicious Directory Via Wget · sigma-rule
- Download from Suspicious Dyndns Hosts · sigma-rule
- Executable from Webdav · sigma-rule
- Exploit Framework User Agent · sigma-rule
- File Download And Execution Via IEExec.EXE · sigma-rule
- File Download From Browser Process Via Inline URL · sigma-rule
- File Download From IP Based URL Via CertOC.EXE · sigma-rule
- File Download Using Notepad++ GUP Utility · sigma-rule
- File Download Via Bitsadmin · sigma-rule
- File Download Via Bitsadmin To A Suspicious Target Folder · sigma-rule
- File Download via CertOC.EXE · sigma-rule
- File Download Via Nscurl - MacOS · sigma-rule
- File Download Via Windows Defender MpCmpRun.EXE · sigma-rule
- File Download with Headless Browser · sigma-rule
- File With Suspicious Extension Downloaded Via Bitsadmin · sigma-rule
- Finger.EXE Execution · sigma-rule
- Github Self-Hosted Runner Execution · sigma-rule
- GoToAssist Temporary Installation Artefact · sigma-rule
- Gzip Archive Decode Via PowerShell · sigma-rule
- HackTool - BabyShark Agent Default URL Pattern · sigma-rule
- HackTool - CobaltStrike Malleable Profile Patterns - Proxy · sigma-rule
- HackTool - Empire UserAgent URI Combo · sigma-rule
- HackTool - Htran/NATBypass Execution · sigma-rule
- HackTool - Inveigh Execution Artefacts · sigma-rule
- HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators · sigma-rule
- HackTool - SharpChisel Execution · sigma-rule
- HackTool - SILENTTRINITY Stager DLL Load · sigma-rule
- HackTool - SILENTTRINITY Stager Execution · sigma-rule
- Hidden Flag Set On File/Directory Via Chflags - MacOS · sigma-rule
- Hijack Legit RDP Session to Move Laterally · sigma-rule
- HTTP Request With Empty User Agent · sigma-rule
- Import LDAP Data Interchange Format File Via Ldifde.EXE · sigma-rule
- Insensitive Subfolder Search Via Findstr.EXE · sigma-rule
- Installation of TeamViewer Desktop · sigma-rule
- Legitimate Application Writing Files In Uncommon Location · sigma-rule
- Local Network Connection Initiated By Script Interpreter · sigma-rule
- Lolbas OneDriveStandaloneUpdater.exe Proxy Download · sigma-rule
- Malicious IP Address Sign-In Failure Rate · sigma-rule
- Malicious IP Address Sign-In Suspicious · sigma-rule
- Malware User Agent · sigma-rule
- Mesh Agent Service Installation · sigma-rule
- MsiExec Web Install · sigma-rule
- Mstsc.EXE Execution With Local RDP File · sigma-rule
- Netcat The Powershell Version · sigma-rule
- Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder · sigma-rule
- Network Communication Initiated To Portmap.IO Domain · sigma-rule
- Network Connection Initiated By IMEWDBLD.EXE · sigma-rule
- Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location · sigma-rule
- Network Connection Initiated To AzureWebsites.NET By Non-Browser Process · sigma-rule
- Network Connection Initiated To BTunnels Domains · sigma-rule
- Network Connection Initiated To Cloudflared Tunnels Domains · sigma-rule
- Network Connection Initiated To DevTunnels Domain · sigma-rule
- Network Connection Initiated To Visual Studio Code Tunnels Domain · sigma-rule
- Network Connection Initiated via Finger.EXE · sigma-rule
- Network Connection Initiated Via Notepad.EXE · sigma-rule
- New Connection Initiated To Potential Dead Drop Resolver Domain · sigma-rule
- New Outlook Macro Created · sigma-rule
- New Port Forwarding Rule Added Via Netsh.EXE · sigma-rule
- New PortProxy Registry Entry Added · sigma-rule
- Ngrok Usage with Remote Desktop Service · sigma-rule
- Non-Mail Client IMAP Connection Hunt Starter · sigma-rule
- OpenCanary - HTTPPROXY Login Attempt · sigma-rule
- OpenCanary - Telnet Login Attempt · sigma-rule
- OpenEDR Spawning Command Shell · sigma-rule
- Outbound Network Connection Initiated By Microsoft Dialer · sigma-rule
- Outbound Network Connection Initiated By Script Interpreter · sigma-rule
- Outbound Network Connection To Public IP Via Winlogon · sigma-rule
- Outlook Macro Execution Without Warning Setting Enabled · sigma-rule
- Password Protected ZIP File Opened (Suspicious Filenames) · sigma-rule
- Port Forwarding Activity Via SSH.EXE · sigma-rule
- Potential Amazon SSM Agent Hijacking · sigma-rule
- Potential Base64 Encoded User-Agent · sigma-rule
- Potential COM Objects Download Cradles Usage - Process Creation · sigma-rule
- Potential COM Objects Download Cradles Usage - PS Script · sigma-rule
- Potential DLL File Download Via PowerShell Invoke-WebRequest · sigma-rule
- Potential Download/Upload Activity Using Type Command · sigma-rule
- Potential In-Memory Download And Compile Of Payloads · sigma-rule
- Potential Linux Amazon SSM Agent Hijacking · sigma-rule
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting · sigma-rule
- Potential RDP Tunneling Via Plink · sigma-rule
- Potential RDP Tunneling Via SSH · sigma-rule
- Potential Remote Desktop Connection to Non-Domain Host · sigma-rule
- Potential SSH Tunnel Persistence Install Using A Scheduled Task · sigma-rule
- Potentially Suspicious File Creation by OpenEDR's ITSMService · sigma-rule
- Potentially Suspicious Malware Callback Communication · sigma-rule
- Potentially Suspicious Malware Callback Communication - Linux · sigma-rule
- Potentially Suspicious Network Connection To Notion API · sigma-rule
- Potentially Suspicious Rundll32.EXE Execution of UDL File · sigma-rule
- Potentially Suspicious Usage Of Qemu · sigma-rule
- PowerShell Download Via Net.WebClient - PowerShell Classic · sigma-rule
- PowerShell MSI Install via WindowsInstaller COM From Remote Location · sigma-rule
- PrintBrm ZIP Creation of Extraction · sigma-rule
- Process Initiated Network Connection To Ngrok Domain · sigma-rule
- PUA - 3Proxy Execution · sigma-rule
- PUA - Chisel Tunneling Tool Execution · sigma-rule
- PUA - Fast Reverse Proxy (FRP) Execution · sigma-rule
- PUA - Netcat Suspicious Execution · sigma-rule
- PUA - Ngrok Execution · sigma-rule
- PUA - Nimgrab Execution · sigma-rule
- PUA - NPS Tunneling Tool Execution · sigma-rule
- PUA- IOX Tunneling Tool Execution · sigma-rule
- PwnDrp Access · sigma-rule
- Query Tor Onion Address - DNS Client · sigma-rule
- QuickAssist Execution · sigma-rule
- Raw Paste Service Access · sigma-rule
- RDP Over Reverse SSH Tunnel · sigma-rule
- RDP over Reverse SSH Tunnel WFP · sigma-rule
- RDP Port Forwarding Rule Added Via Netsh.EXE · sigma-rule
- RDP to HTTP or HTTPS Target Ports · sigma-rule
- Remote Access Tool - AnyDesk Execution · sigma-rule
- Remote Access Tool - Anydesk Execution From Suspicious Folder · sigma-rule
- Remote Access Tool - AnyDesk Incoming Connection · sigma-rule
- Remote Access Tool - AnyDesk Piped Password Via CLI · sigma-rule
- Remote Access Tool - AnyDesk Silent Installation · sigma-rule
- Remote Access Tool - GoToAssist Execution · sigma-rule
- Remote Access Tool - LogMeIn Execution · sigma-rule
- Remote Access Tool - MeshAgent Command Execution via MeshCentral · sigma-rule
- Remote Access Tool - NetSupport Execution · sigma-rule
- Remote Access Tool - Potential MeshAgent Execution - MacOS · sigma-rule
- Remote Access Tool - Potential MeshAgent Execution - Windows · sigma-rule
- Remote Access Tool - Renamed MeshAgent Execution - MacOS · sigma-rule
- Remote Access Tool - Renamed MeshAgent Execution - Windows · sigma-rule
- Remote Access Tool - ScreenConnect Execution · sigma-rule
- Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution · sigma-rule
- Remote Access Tool - Simple Help Execution · sigma-rule
- Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server · sigma-rule
- Remote Access Tool - UltraViewer Execution · sigma-rule
- Remote File Copy · sigma-rule
- Remote File Download Via Desktopimgdownldr Utility · sigma-rule
- Remote File Download Via Findstr.EXE · sigma-rule
- Renamed Cloudflared.EXE Execution · sigma-rule
- Renamed Visual Studio Code Tunnel Execution · sigma-rule
- Replace.exe Usage · sigma-rule
- Scheduled Task Creation with Curl and PowerShell Execution Combo · sigma-rule
- ScreenConnect Temporary Installation Artefact · sigma-rule
- Sign-In From Malware Infected IP · sigma-rule
- Silence.EDA Detection · sigma-rule
- Suspicious Base64 Encoded User-Agent · sigma-rule
- Suspicious Binary Writes Via AnyDesk · sigma-rule
- Suspicious CertReq Command to Download · sigma-rule
- Suspicious Child Process Of Manage Engine ServiceDesk · sigma-rule
- Suspicious Cobalt Strike DNS Beaconing - DNS Client · sigma-rule
- Suspicious Cobalt Strike DNS Beaconing - Sysmon · sigma-rule
- Suspicious Curl Change User Agents - Linux · sigma-rule
- Suspicious Curl File Upload - Linux · sigma-rule
- Suspicious Curl.EXE Download · sigma-rule
- Suspicious Deno File Written from Remote Source · sigma-rule
- Suspicious Desktopimgdownldr Command · sigma-rule
- Suspicious Desktopimgdownldr Target File · sigma-rule
- Suspicious Diantz Download and Compress Into a CAB File · sigma-rule
- Suspicious DNS Query with B64 Encoded String · sigma-rule
- Suspicious DNS Z Flag Bit Set · sigma-rule
- Suspicious Download From File-Sharing Website Via Bitsadmin · sigma-rule
- Suspicious Download from Office Domain · sigma-rule
- Suspicious Download Via Certutil.EXE · sigma-rule
- Suspicious Dropbox API Usage · sigma-rule
- Suspicious Extrac32 Execution · sigma-rule
- Suspicious File Created by ArcSOC.exe · sigma-rule
- Suspicious File Downloaded From Direct IP Via Certutil.EXE · sigma-rule
- Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE · sigma-rule
- Suspicious FromBase64String Usage On Gzip Archive - Process Creation · sigma-rule
- Suspicious FromBase64String Usage On Gzip Archive - Ps Script · sigma-rule
- Suspicious Installer Package Child Process · sigma-rule
- Suspicious Invoke-WebRequest Execution · sigma-rule
- Suspicious Invoke-WebRequest Execution With DirectIP · sigma-rule
- Suspicious LDAP-Attributes Used · sigma-rule
- Suspicious Mstsc.EXE Execution With Local RDP File · sigma-rule
- Suspicious Non-Browser Network Communication With Google API · sigma-rule
- Suspicious Non-Browser Network Communication With Telegram API · sigma-rule
- Suspicious Outlook Macro Created · sigma-rule
- Suspicious Plink Port Forwarding · sigma-rule
- Suspicious SSL Connection · sigma-rule
- Suspicious TCP Tunnel Via PowerShell Script · sigma-rule
- Suspicious TSCON Start as SYSTEM · sigma-rule
- Suspicious User Agent · sigma-rule
- Suspicious Velociraptor Child Process · sigma-rule
- TacticalRMM Service Installation · sigma-rule
- TeamViewer Domain Query By Non-TeamViewer Application · sigma-rule
- TeamViewer Remote Session · sigma-rule
- Telegram API Access · sigma-rule
- Telegram Bot API Request · sigma-rule
- Testing Usage of Uncommonly Used Port · sigma-rule
- Tor Client/Browser Execution · sigma-rule
- Uncommon Network Connection Initiated By Certutil.EXE · sigma-rule
- Use of UltraVNC Remote Access Software · sigma-rule
- Visual Studio Code Tunnel Execution · sigma-rule
- Visual Studio Code Tunnel Service Installation · sigma-rule
- Visual Studio Code Tunnel Shell Execution · sigma-rule
- Wannacry Killswitch Domain · sigma-rule
- Wget Creating Files in Tmp Directory · sigma-rule
- Windows PowerShell User Agent · sigma-rule
- Windows WebDAV User Agent · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.