attack.defense-impairment — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• A Rule Has Been Deleted From The Windows Firewall Exception List · sigma-rule
• Activate Suppression of Windows Security Center Notifications · sigma-rule
• Active Directory Certificate Services Denied Certificate Enrollment Request · sigma-rule
• AD Object WriteDAC Access · sigma-rule
• Add DisallowRun Execution to Registry · sigma-rule
• Add or Remove Computer from DC · sigma-rule
• Add SafeBoot Keys Via Reg Utility · sigma-rule
• All Rules Have Been Deleted From The Windows Firewall Configuration · sigma-rule
• Allow RDP Remote Assistance Feature · sigma-rule
• AMSI Bypass Pattern Assembly GetType · sigma-rule
• AMSI Disabled via Registry Modification · sigma-rule
• Antivirus Filter Driver Disallowed On Dev Drive - Registry · sigma-rule
• ASLR Disabled Via Sysctl or Direct Syscall - Linux · sigma-rule
• Audit Policy Tampering Via Auditpol · sigma-rule
• Audit Policy Tampering Via NT Resource Kit Auditpol · sigma-rule
• Audit Rules Deleted Via Auditctl · sigma-rule
• Auditing Configuration Changes on Linux Host · sigma-rule
• AWS CloudTrail Important Change · sigma-rule
• AWS Config Disabling Channel/Recorder · sigma-rule
• AWS GuardDuty Detector Deleted Or Updated · sigma-rule
• AWS GuardDuty Important Change · sigma-rule
• AWS Identity Center Identity Provider Change · sigma-rule
• AWS SecurityHub Findings Evasion · sigma-rule
• Azure Active Directory Hybrid Health AD FS New Server · sigma-rule
• Azure Active Directory Hybrid Health AD FS Service Delete · sigma-rule
• Azure AD Only Single Factor Authentication Required · sigma-rule
• Azure Firewall Modified or Deleted · sigma-rule
• Azure Firewall Rule Collection Modified or Deleted · sigma-rule
• Azure Kubernetes Events Deleted · sigma-rule
• Azure Network Firewall Policy Modified or Deleted · sigma-rule
• Bitbucket Audit Log Configuration Updated · sigma-rule
• Bitbucket Global Secret Scanning Rule Deleted · sigma-rule
• Bitbucket Global SSH Settings Changed · sigma-rule
• Bitbucket Project Secret Scanning Allowlist Added · sigma-rule
• Bitbucket Secret Scanning Exempt Repository Added · sigma-rule
• Bitbucket Secret Scanning Rule Deleted · sigma-rule
• Bpfdoor TCP Ports Redirect · sigma-rule
• CA Policy Removed by Non Approved Actor · sigma-rule
• CA Policy Updated by Non Approved Actor · sigma-rule
• Certificate-Based Authentication Enabled · sigma-rule
• Change the Fax Dll · sigma-rule
• Change to Authentication Method · sigma-rule
• Change User Account Associated with the FAX Service · sigma-rule
• Change Winevt Channel Access Permission Via Registry · sigma-rule
• Changes to Device Registration Policy · sigma-rule
• Chmod Targeting Sensitive Directories · sigma-rule
• Cisco Crypto Commands · sigma-rule
• Cisco Disabling Logging · sigma-rule
• Cisco Dot1x Disabled · sigma-rule
• Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall · sigma-rule
• ClickOnce Trust Prompt Tampering · sigma-rule
• CrashControl CrashDump Disabled · sigma-rule
• Devcon Execution Disabling VMware VMCI Device · sigma-rule
• DHCP Callout DLL Installation · sigma-rule
• Directory Service Restore Mode(DSRM) Registry Value Tampering · sigma-rule
• Disable Exploit Guard Network Protection on Windows Defender · sigma-rule
• Disable Internal Tools or Feature in Registry · sigma-rule
• Disable Microsoft Defender Firewall via Registry · sigma-rule
• Disable of ETW Trace - Powershell · sigma-rule
• Disable Or Stop Services · sigma-rule
• Disable Privacy Settings Experience in Registry · sigma-rule
• Disable PUA Protection on Windows Defender · sigma-rule
• Disable Security Events Logging Adding Reg Key MiniNt · sigma-rule
• Disable Security Tools · sigma-rule
• Disable System Firewall · sigma-rule
• Disable Tamper Protection on Windows Defender · sigma-rule
• Disable Windows Defender AV Security Monitoring · sigma-rule
• Disable Windows Defender Functionalities Via Registry Keys · sigma-rule
• Disable Windows Event Logging Via Registry · sigma-rule
• Disable Windows Firewall by Registry · sigma-rule
• Disable Windows IIS HTTP Logging · sigma-rule
• Disable Windows Security Center Notifications · sigma-rule
• Disable-WindowsOptionalFeature Command PowerShell · sigma-rule
• Disabled IE Security Features · sigma-rule
• Disabled MFA to Bypass Authentication Mechanisms · sigma-rule
• Disabled Volume Snapshots · sigma-rule
• Disabled Windows Defender Eventlog · sigma-rule
• Disabling Multi Factor Authentication · sigma-rule
• Disabling Security Tools · sigma-rule
• Disabling Security Tools - Builtin · sigma-rule
• Disabling Windows Defender WMI Autologger Session via Reg.exe · sigma-rule
• Dism Remove Online Package · sigma-rule
• DNS-over-HTTPS Enabled by Registry · sigma-rule
• Dropping Of Password Filter DLL · sigma-rule
• Enable LM Hash Storage · sigma-rule
• Enable LM Hash Storage - ProcCreation · sigma-rule
• Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback · sigma-rule
• ESXi Syslog Configuration Change Via ESXCLI · sigma-rule
• ETW Logging Disabled For rpcrt4.dll · sigma-rule
• ETW Logging Disabled For SCM · sigma-rule
• ETW Logging Disabled In .NET Processes - Registry · sigma-rule
• ETW Logging Disabled In .NET Processes - Sysmon Registry · sigma-rule
• ETW Logging Tamper In .NET Processes Via CommandLine · sigma-rule
• ETW Logging/Processing Option Disabled On IIS Server · sigma-rule
• ETW Trace Evasion Activity · sigma-rule
• Eventlog Cleared · sigma-rule
• EVTX Created In Uncommon Location · sigma-rule
• File or Folder Permissions Change · sigma-rule
• Filter Driver Unloaded Via Fltmc.EXE · sigma-rule
• Firewall Disabled via Netsh.EXE · sigma-rule
• Firewall Rule Deleted Via Netsh.EXE · sigma-rule
• Flush Iptables Ufw Chain · sigma-rule
• Folder Removed From Exploit Guard ProtectedFolders List - Registry · sigma-rule
• FortiGate - Firewall Address Object Added · sigma-rule
• FortiGate - New Firewall Policy Added · sigma-rule
• Gatekeeper Bypass via Xattr · sigma-rule
• Github High Risk Configuration Disabled · sigma-rule
• Github Push Protection Bypass Detected · sigma-rule
• Github Push Protection Disabled · sigma-rule
• Github Secret Scanning Feature Disabled · sigma-rule
• Google Cloud Firewall Modified or Deleted · sigma-rule
• Group Policy Abuse for Privilege Addition · sigma-rule
• HackTool - CobaltStrike BOF Injection Pattern · sigma-rule
• Hacktool - EDR-Freeze Execution · sigma-rule
• HackTool - EDRSilencer Execution · sigma-rule
• HackTool - EDRSilencer Execution - Filter Added · sigma-rule
• HackTool - PowerTool Execution · sigma-rule
• HackTool - SharpEvtMute DLL Load · sigma-rule
• HackTool - SharpEvtMute Execution · sigma-rule
• HackTool - Stracciatella Execution · sigma-rule
• HackTool - SysmonEnte Execution · sigma-rule
• Hide Schedule Task Via Index Value Tamper · sigma-rule
• HTTP Logging Disabled On IIS Server · sigma-rule
• Hypervisor Enforced Paging Translation Disabled · sigma-rule
• Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine · sigma-rule
• Important Windows Event Auditing Disabled · sigma-rule
• Important Windows Eventlog Cleared · sigma-rule
• Imports Registry Key From a File · sigma-rule
• Imports Registry Key From an ADS · sigma-rule
• Indicator Removal on Host - Clear Mac System Logs · sigma-rule
• Install Root Certificate · sigma-rule
• Kaspersky Endpoint Security Stopped Via CommandLine - Linux · sigma-rule
• Linux Logs Clearing Attempts · sigma-rule
• Load Of RstrtMgr.DLL By A Suspicious Process · sigma-rule
• Load Of RstrtMgr.DLL By An Uncommon Process · sigma-rule
• Logging Configuration Changes on Linux Host · sigma-rule
• LSA PPL Protection Setting Modification via CommandLine · sigma-rule
• Macro Enabled In A Potentially Suspicious Document · sigma-rule
• Microsoft Defender Tamper Protection Trigger · sigma-rule
• Microsoft Malware Protection Engine Crash · sigma-rule
• Microsoft Malware Protection Engine Crash - WER · sigma-rule
• Microsoft Office Protected View Disabled · sigma-rule
• Modification of IE Registry Settings · sigma-rule
• Modify Group Policy Settings · sigma-rule
• Modify Group Policy Settings - ScriptBlockLogging · sigma-rule
• Modify System Firewall · sigma-rule
• NET NGenAssemblyUsageLog Registry Key Tamper · sigma-rule
• NetNTLM Downgrade Attack · sigma-rule
• NetNTLM Downgrade Attack - Registry · sigma-rule
• Netsh Allow Group Policy on Microsoft Defender Firewall · sigma-rule
• New BgInfo.EXE Custom DB Path Registry Configuration · sigma-rule
• New BgInfo.EXE Custom VBScript Registry Configuration · sigma-rule
• New BgInfo.EXE Custom WMI Query Registry Configuration · sigma-rule
• New DNS ServerLevelPluginDll Installed · sigma-rule
• New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE · sigma-rule
• New Federated Domain Added · sigma-rule
• New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application · sigma-rule
• New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE · sigma-rule
• New Firewall Rule Added Via Netsh.EXE · sigma-rule
• New Module Module Added To IIS Server · sigma-rule
• New Network ACL Entry Added · sigma-rule
• New Network Route Added · sigma-rule
• New Root Certificate Authority Added · sigma-rule
• New Root Certificate Installed Via CertMgr.EXE · sigma-rule
• New Root Certificate Installed Via Certutil.EXE · sigma-rule
• Non-privileged Usage of Reg or Powershell · sigma-rule
• Obfuscated PowerShell OneLiner Execution · sigma-rule
• Office Macros Warning Disabled · sigma-rule
• Okta MFA Reset or Deactivated · sigma-rule
• Okta User Session Start Via An Anonymising Proxy Service · sigma-rule
• Outlook EnableUnsafeClientMailRules Setting Enabled - Registry · sigma-rule
• Persistence Via New SIP Provider · sigma-rule
• Possible DC Shadow Attack · sigma-rule
• Possible Shadow Credentials Added · sigma-rule
• Potential AMSI Bypass Script Using NULL Bits · sigma-rule
• Potential AMSI Bypass Using NULL Bits · sigma-rule
• Potential AMSI Bypass Via .NET Reflection · sigma-rule
• Potential AMSI COM Server Hijacking · sigma-rule
• Potential AutoLogger Sessions Tampering · sigma-rule
• Potential EventLog File Location Tampering · sigma-rule
• Potential Persistence Via Custom Protocol Handler · sigma-rule
• Potential Persistence Via Event Viewer Events.asp · sigma-rule
• Potential Persistence Via Outlook Home Page · sigma-rule
• Potential Persistence Via Outlook Today Page · sigma-rule
• Potential Privileged System Service Operation - SeLoadDriverPrivilege · sigma-rule
• Potential Qakbot Registry Activity · sigma-rule
• Potential Secure Deletion with SDelete · sigma-rule
• Potential Suspicious Activity Using SeCEdit · sigma-rule
• Potential Suspicious Registry File Imported Via Reg.EXE · sigma-rule
• Potential Tampering With RDP Related Registry Keys Via Reg.EXE · sigma-rule
• Potential Tampering With Security Products Via WMIC · sigma-rule
• Potential Windows Defender Tampering Via Wmic.EXE · sigma-rule
• Potentially Suspicious Desktop Background Change Using Reg.EXE · sigma-rule
• Potentially Suspicious Desktop Background Change Via Registry · sigma-rule
• Potentially Suspicious NTFS Symlink Behavior Modification · sigma-rule
• Powershell Base64 Encoded MpPreference Cmdlet · sigma-rule
• Powershell Defender Disable Scan Feature · sigma-rule
• Powershell Defender Exclusion · sigma-rule
• PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' · sigma-rule
• Powershell Install a DLL in System Directory · sigma-rule
• PowerShell Logging Disabled Via Registry Key Tampering · sigma-rule
• PowerShell Script Change Permission Via Set-Acl - PsScript · sigma-rule
• PowerShell Set-Acl On Windows Folder - PsScript · sigma-rule
• PPL Tampering Via WerFaultSecure · sigma-rule
• Previously Installed IIS Module Was Removed · sigma-rule
• PUA - CleanWipe Execution · sigma-rule
• Python Function Execution Security Warning Disabled In Excel · sigma-rule
• Python Function Execution Security Warning Disabled In Excel - Registry · sigma-rule
• Raccine Uninstall · sigma-rule
• RDP Connection Allowed Via Netsh.EXE · sigma-rule
• RDP Sensitive Settings Changed · sigma-rule
• RDP Sensitive Settings Changed to Zero · sigma-rule
• RedMimicry Winnti Playbook Registry Manipulation · sigma-rule
• Reg Add Suspicious Paths · sigma-rule
• Registry Entries For Azorult Malware · sigma-rule
• Registry Explorer Policy Modification · sigma-rule
• Registry Hide Function from User · sigma-rule
• Registry Manipulation via WMI Stdregprov · sigma-rule
• Registry Modification Attempt Via VBScript · sigma-rule
• Registry Modification Attempt Via VBScript - PowerShell · sigma-rule
• Registry Modification for OCI DLL Redirection · sigma-rule
• Registry Modification of MS-settings Protocol Handler · sigma-rule
• Registry Modification Via Regini.EXE · sigma-rule
• Registry Tampering by Potentially Suspicious Processes · sigma-rule
• Remote Registry Lateral Movement · sigma-rule
• Removal Of AMSI Provider Registry Keys · sigma-rule
• Removal Of Index Value to Hide Schedule Task - Registry · sigma-rule
• Removal of Potential COM Hijacking Registry Keys · sigma-rule
• Removal Of SD Value to Hide Schedule Task - Registry · sigma-rule
• Remove Immutable File Attribute · sigma-rule
• Remove Immutable File Attribute - Auditd · sigma-rule
• Renamed BOINC Client Execution · sigma-rule
• RestrictedAdminMode Registry Value Tampering · sigma-rule
• RestrictedAdminMode Registry Value Tampering - ProcCreation · sigma-rule
• Root Certificate Installed - PowerShell · sigma-rule
• Root Certificate Installed From Susp Locations · sigma-rule
• Run Once Task Configuration in Registry · sigma-rule
• Run Once Task Execution as Configured in Registry · sigma-rule
• SafeBoot Registry Key Deleted Via Reg.EXE · sigma-rule
• Scripted Diagnostics Turn Off Check Enabled - Registry · sigma-rule
• Security Event Logging Disabled via MiniNt Registry Key - Process · sigma-rule
• Security Event Logging Disabled via MiniNt Registry Key - Registry Set · sigma-rule
• Security Eventlog Cleared · sigma-rule
• Security Service Disabled Via Reg.EXE · sigma-rule
• Service Binary in Suspicious Folder · sigma-rule
• Service Registry Key Deleted Via Reg.EXE · sigma-rule
• Service Startup Type Change Via Wmic.EXE · sigma-rule
• Service StartupType Change Via PowerShell Set-Service · sigma-rule
• Service StartupType Change Via Sc.EXE · sigma-rule
• ShimCache Flush · sigma-rule
• Startup/Logon Script Added to Group Policy Object · sigma-rule
• Suspicious Application Allowed Through Exploit Guard · sigma-rule
• Suspicious Eventlog Clear · sigma-rule
• Suspicious Eventlog Clearing or Configuration Change Activity · sigma-rule
• Suspicious Execution via macOS Script Editor · sigma-rule
• Suspicious Invoke-Item From Mount-DiskImage · sigma-rule
• Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location · sigma-rule
• Suspicious Mount-DiskImage · sigma-rule
• Suspicious Package Installed - Linux · sigma-rule
• Suspicious Path In Keyboard Layout IME File Registry Value · sigma-rule
• Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze · sigma-rule
• Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs · sigma-rule
• Suspicious PROCEXP152.sys File Created In TMP · sigma-rule
• Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE · sigma-rule
• Suspicious Recursive Takeown · sigma-rule
• Suspicious Registry Modification From ADS Via Regini.EXE · sigma-rule
• Suspicious Service Installed · sigma-rule
• Suspicious Svchost Process Access · sigma-rule
• Suspicious Unblock-File · sigma-rule
• Suspicious Uninstall of Windows Defender Feature via PowerShell · sigma-rule
• Suspicious VBoxDrvInst.exe Parameters · sigma-rule
• Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE · sigma-rule
• Suspicious Windows Defender Registry Key Tampering Via Reg.EXE · sigma-rule
• Suspicious Windows Service Tampering · sigma-rule
• Suspicious Windows Trace ETW Session Tamper Via Logman.EXE · sigma-rule
• Suspicious X509Enrollment - Process Creation · sigma-rule
• Suspicious X509Enrollment - Ps Script · sigma-rule
• Sysinternals PsSuspend Suspicious Execution · sigma-rule
• Syslog Clearing or Removal Via System Utilities · sigma-rule
• Sysmon Application Crashed · sigma-rule
• Sysmon Channel Reference Deletion · sigma-rule
• Sysmon Configuration Update · sigma-rule
• Sysmon Driver Altitude Change · sigma-rule
• Sysmon Driver Unloaded Via Fltmc.EXE · sigma-rule
• Tamper Windows Defender - PSClassic · sigma-rule
• Tamper Windows Defender - ScriptBlockLogging · sigma-rule
• Tamper Windows Defender Remove-MpPreference · sigma-rule
• Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging · sigma-rule
• Tamper With Sophos AV Registry Keys · sigma-rule
• Taskkill Symantec Endpoint Protection · sigma-rule
• Terminal Server Client Connection History Cleared - Registry · sigma-rule
• The Windows Defender Firewall Service Failed To Load Group Policy · sigma-rule
• Trust Access Disable For VBApplications · sigma-rule
• UFW Disable Attempt · sigma-rule
• Uncommon Extension In Keyboard Layout IME File Registry Value · sigma-rule
• Uncommon Microsoft Office Trusted Location Added · sigma-rule
• Uncommon New Firewall Rule Added In Windows Firewall Exception List · sigma-rule
• Uninstall Crowdstrike Falcon Sensor · sigma-rule
• Uninstall Sysinternals Sysmon · sigma-rule
• User Added To Group With CA Policy Modification Access · sigma-rule
• User Removed From Group With CA Policy Modification Access · sigma-rule
• User Shell Folders Registry Modification via CommandLine · sigma-rule
• Vulnerable Driver Blocklist Registry Tampering Via CommandLine · sigma-rule
• Wdigest CredGuard Registry Modification · sigma-rule
• Wdigest Enable UseLogonCredential · sigma-rule
• Weak Encryption Enabled and Kerberoast · sigma-rule
• WFP Filter Added via Registry · sigma-rule
• Win Defender Restored Quarantine File · sigma-rule
• WinDivert Driver Load · sigma-rule
• Windows AMSI Related Registry Tampering Via CommandLine · sigma-rule
• Windows AppX Deployment Full Trust Package Installation · sigma-rule
• Windows AppX Deployment Unsigned Package Installation · sigma-rule
• Windows Credential Guard Disabled - Registry · sigma-rule
• Windows Credential Guard Registry Tampering Via CommandLine · sigma-rule
• Windows Credential Guard Related Registry Value Deleted - Registry · sigma-rule
• Windows Default Domain GPO Modification · sigma-rule
• Windows Default Domain GPO Modification via GPME · sigma-rule
• Windows Defender Configuration Changes · sigma-rule
• Windows Defender Context Menu Removed · sigma-rule
• Windows Defender Definition Files Removed · sigma-rule
• Windows Defender Exclusion List Modified · sigma-rule
• Windows Defender Exclusion Registry Key - Write Access Requested · sigma-rule
• Windows Defender Exclusions Added · sigma-rule
• Windows Defender Exclusions Added - PowerShell · sigma-rule
• Windows Defender Exclusions Added - Registry · sigma-rule
• Windows Defender Exploit Guard Tamper · sigma-rule
• Windows Defender Firewall Has Been Reset To Its Default Configuration · sigma-rule
• Windows Defender Grace Period Expired · sigma-rule
• Windows Defender Malware And PUA Scanning Disabled · sigma-rule
• Windows Defender Real-time Protection Disabled · sigma-rule
• Windows Defender Real-Time Protection Failure/Restart · sigma-rule
• Windows Defender Service Disabled - Registry · sigma-rule
• Windows Defender Submit Sample Feature Disabled · sigma-rule
• Windows Defender Threat Detection Service Disabled · sigma-rule
• Windows Defender Threat Severity Default Action Modified · sigma-rule
• Windows Defender Virus Scanning Feature Disabled · sigma-rule
• Windows Event Auditing Disabled · sigma-rule
• Windows Event Log Access Tampering Via Registry · sigma-rule
• Windows EventLog Autologger Session Registry Modification Via CommandLine · sigma-rule
• Windows Filtering Platform Blocked Connection From EDR Agent Binary · sigma-rule
• Windows Firewall Disabled via PowerShell · sigma-rule
• Windows Firewall Profile Disabled · sigma-rule
• Windows Firewall Settings Have Been Changed · sigma-rule
• Windows Hypervisor Enforced Code Integrity Disabled · sigma-rule
• Windows MSIX Package Support Framework AI_STUBS Execution · sigma-rule
• Windows Vulnerable Driver Blocklist Disabled · sigma-rule
• Winlogon AllowMultipleTSSessions Enable · sigma-rule
• Write Protect For Storage Disabled · sigma-rule