attack.persistence — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• A Member Was Added to a Security-Enabled Global Group · sigma-rule
• A Member Was Removed From a Security-Enabled Global Group · sigma-rule
• A New Trust Was Created To A Domain · sigma-rule
• A Security-Enabled Global Group Was Deleted · sigma-rule
• Abuse of Service Permissions to Hide Services Via Set-Service · sigma-rule
• Abuse of Service Permissions to Hide Services Via Set-Service - PS · sigma-rule
• Account Created And Deleted Within A Close Time Frame · sigma-rule
• Account Disabled or Blocked for Sign in Attempts · sigma-rule
• Account Tampering - Suspicious Failed Logon Reasons · sigma-rule
• Activate Suppression of Windows Security Center Notifications · sigma-rule
• Active Directory User Backdoors · sigma-rule
• Activity From Anonymous IP Address · sigma-rule
• Add DisallowRun Execution to Registry · sigma-rule
• Add Port Monitor Persistence in Registry · sigma-rule
• Added Credentials to Existing Application · sigma-rule
• Addition of SID History to Active Directory Object · sigma-rule
• Admin User Remote Logon · sigma-rule
• Allow RDP Remote Assistance Feature · sigma-rule
• Allow Service Access Using Security Descriptor Tampering Via Sc.EXE · sigma-rule
• Anomalous User Activity · sigma-rule
• Antivirus Web Shell Detection · sigma-rule
• App Assigned To Azure RBAC/Microsoft Entra Role · sigma-rule
• App Granted Privileged Delegated Or App Permissions · sigma-rule
• Application AppID Uri Configuration Changes · sigma-rule
• Application URI Configuration Changes · sigma-rule
• Application Using Device Code Authentication Flow · sigma-rule
• Applications That Are Using ROPC Authentication Flow · sigma-rule
• Aruba Network Service Potential DLL Sideloading · sigma-rule
• Atbroker Registry Change · sigma-rule
• Attempts of Kerberos Coercion Via DNS SPN Spoofing · sigma-rule
• Atypical Travel · sigma-rule
• Authentications To Important Apps Using Single Factor Authentication · sigma-rule
• AWS ECS Task Definition That Queries The Credential Endpoint · sigma-rule
• AWS ElastiCache Security Group Created · sigma-rule
• AWS IAM Backdoor Users Keys · sigma-rule
• AWS IAM S3Browser LoginProfile Creation · sigma-rule
• AWS IAM S3Browser Templated S3 Bucket Policy Creation · sigma-rule
• AWS IAM S3Browser User or AccessKey Creation · sigma-rule
• AWS Identity Center Identity Provider Change · sigma-rule
• AWS Key Pair Import Activity · sigma-rule
• AWS Root Credentials · sigma-rule
• AWS Route 53 Domain Transfer Lock Disabled · sigma-rule
• AWS Route 53 Domain Transferred to Another Account · sigma-rule
• AWS SAML Provider Deletion Activity · sigma-rule
• AWS Successful Console Login Without MFA · sigma-rule
• AWS Suspicious SAML Activity · sigma-rule
• AWS User Login Profile Was Modified · sigma-rule
• Azure AD Only Single Factor Authentication Required · sigma-rule
• Azure AD Threat Intelligence · sigma-rule
• Azure Domain Federation Settings Modified · sigma-rule
• Azure Kubernetes Admission Controller · sigma-rule
• Azure Kubernetes CronJob · sigma-rule
• Azure Login Bypassing Conditional Access Policies · sigma-rule
• Azure Subscription Permission Elevation Via ActivityLogs · sigma-rule
• Azure Subscription Permission Elevation Via AuditLogs · sigma-rule
• Azure Unusual Authentication Interruption · sigma-rule
• Bitbucket Global Permission Changed · sigma-rule
• Bitbucket User Login Failure · sigma-rule
• Bitlocker Key Retrieval · sigma-rule
• BITS Transfer Job Download From Direct IP · sigma-rule
• BITS Transfer Job Download From File Sharing Domains · sigma-rule
• BITS Transfer Job Download To Potential Suspicious Folder · sigma-rule
• BITS Transfer Job Downloading File Potential Suspicious Extension · sigma-rule
• BITS Transfer Job With Uncommon Or Suspicious Remote TLD · sigma-rule
• Bitsadmin to Uncommon IP Server Address · sigma-rule
• Bitsadmin to Uncommon TLD · sigma-rule
• Bulk Deletion Changes To Privileged Account Permissions · sigma-rule
• Bypass UAC Using Event Viewer · sigma-rule
• CA Policy Removed by Non Approved Actor · sigma-rule
• CA Policy Updated by Non Approved Actor · sigma-rule
• Certificate Request Export to Exchange Webserver · sigma-rule
• Certificate-Based Authentication Enabled · sigma-rule
• Change Default File Association To Executable Via Assoc · sigma-rule
• Change Default File Association Via Assoc · sigma-rule
• Change the Fax Dll · sigma-rule
• Change to Authentication Method · sigma-rule
• Change User Account Associated with the FAX Service · sigma-rule
• Changes To PIM Settings · sigma-rule
• Changing Existing Service ImagePath Value Via Reg.EXE · sigma-rule
• Chopper Webshell Process Pattern · sigma-rule
• Chromium Browser Instance Executed With Custom Extension · sigma-rule
• Cisco BGP Authentication Failures · sigma-rule
• Cisco Dot1x Disabled · sigma-rule
• Cisco LDP Authentication Failures · sigma-rule
• Cisco Local Accounts · sigma-rule
• Cisco Modify Configuration · sigma-rule
• Classes Autorun Keys Modification · sigma-rule
• ClickOnce Trust Prompt Tampering · sigma-rule
• CobaltStrike Service Installations - Security · sigma-rule
• CobaltStrike Service Installations - System · sigma-rule
• Code Executed Via Office Add-in XLL File · sigma-rule
• Code Injection by ld.so Preload · sigma-rule
• CodeIntegrity - Blocked Driver Load With Revoked Certificate · sigma-rule
• CodeIntegrity - Blocked Image/Driver Load For Policy Violation · sigma-rule
• COM Hijack via Sdclt · sigma-rule
• COM Hijacking via TreatAs · sigma-rule
• COM Object Hijacking Via Modification Of Default System CLSID Default Value · sigma-rule
• Common Autorun Keys Modification · sigma-rule
• Communication To Uncommon Destination Ports · sigma-rule
• Control Panel Items · sigma-rule
• CrashControl CrashDump Disabled · sigma-rule
• Creation Exe for Service with Unquoted Path · sigma-rule
• Creation of a Local Hidden User Account by Registry · sigma-rule
• Creation Of A Local User Account · sigma-rule
• Creation Of An User Account · sigma-rule
• Creation Of Non-Existent System DLL · sigma-rule
• Creation of WerFault.exe/Wer.dll in Unusual Folder · sigma-rule
• CurrentControlSet Autorun Keys Modification · sigma-rule
• CurrentVersion Autorun Keys Modification · sigma-rule
• CurrentVersion NT Autorun Keys Modification · sigma-rule
• Default RDP Port Changed to Non Standard Port · sigma-rule
• Deny Service Access Using Security Descriptor Tampering Via Sc.EXE · sigma-rule
• Desktop.INI Created by Uncommon Process · sigma-rule
• Devcon Execution Disabling VMware VMCI Device · sigma-rule
• Device Registration or Join Without MFA · sigma-rule
• DHCP Callout DLL Installation · sigma-rule
• DHCP Server Error Failed Loading the CallOut DLL · sigma-rule
• DHCP Server Loaded the CallOut DLL · sigma-rule
• Direct Autorun Keys Modification · sigma-rule
• Directory Service Restore Mode(DSRM) Registry Value Tampering · sigma-rule
• Disable Internal Tools or Feature in Registry · sigma-rule
• Disable Security Events Logging Adding Reg Key MiniNt · sigma-rule
• Disable Windows Security Center Notifications · sigma-rule
• Disabled MFA to Bypass Authentication Mechanisms · sigma-rule
• Disabling Multi Factor Authentication · sigma-rule
• DLL Execution Via Register-cimprovider.exe · sigma-rule
• DLL Load via LSASS · sigma-rule
• DLL Search Order Hijackig Via Additional Space in Path · sigma-rule
• DLL Sideloading by VMware Xfer Utility · sigma-rule
• DLL Sideloading Of ShellChromeAPI.DLL · sigma-rule
• DMSA Link Attributes Modified · sigma-rule
• DMSA Service Account Created in Specific OUs - PowerShell · sigma-rule
• DNS HybridConnectionManager Service Bus · sigma-rule
• DNS Server Error Failed Loading the ServerLevelPluginDLL · sigma-rule
• DNS-over-HTTPS Enabled by Registry · sigma-rule
• Driver Load From A Temporary Directory · sigma-rule
• Dropping Of Password Filter DLL · sigma-rule
• Enable LM Hash Storage · sigma-rule
• Enable LM Hash Storage - ProcCreation · sigma-rule
• Enabled User Right in AD to Control User Objects · sigma-rule
• Enabling COR Profiler Environment Variables · sigma-rule
• ESXi Account Creation Via ESXCLI · sigma-rule
• ESXi Admin Permission Assigned To Account Via ESXCLI · sigma-rule
• ETW Logging Disabled For rpcrt4.dll · sigma-rule
• ETW Logging Disabled For SCM · sigma-rule
• ETW Logging Disabled In .NET Processes - Registry · sigma-rule
• ETW Logging Disabled In .NET Processes - Sysmon Registry · sigma-rule
• ETW Logging/Processing Option Disabled On IIS Server · sigma-rule
• Exchange Set OabVirtualDirectory ExternalUrl Property · sigma-rule
• External Remote RDP Logon from Public IP · sigma-rule
• External Remote SMB Logon from Public IP · sigma-rule
• Failed Authentications From Countries You Do Not Operate Out Of · sigma-rule
• Failed Logon From Public IP · sigma-rule
• Failed MSExchange Transport Agent Installation · sigma-rule
• Fax Service DLL Search Order Hijack · sigma-rule
• File Creation In Suspicious Directory By Msdt.EXE · sigma-rule
• File Download Via Bitsadmin · sigma-rule
• File Download Via Bitsadmin To A Suspicious Target Folder · sigma-rule
• File With Suspicious Extension Downloaded Via Bitsadmin · sigma-rule
• FortiGate - New Administrator Account Created · sigma-rule
• FortiGate - New Local User Created · sigma-rule
• FortiGate - New VPN SSL Web Portal Added · sigma-rule
• FortiGate - VPN SSL Settings Modified · sigma-rule
• GCP Access Policy Deleted · sigma-rule
• Github Fork Private Repositories Setting Enabled/Cleared · sigma-rule
• Github High Risk Configuration Disabled · sigma-rule
• Github New Secret Created · sigma-rule
• Github Outside Collaborator Detected · sigma-rule
• Github Repository/Organization Transferred · sigma-rule
• Github Self Hosted Runner Changes Detected · sigma-rule
• Github SSH Certificate Configuration Changed · sigma-rule
• Google Cloud Kubernetes Admission Controller · sigma-rule
• Google Workspace Application Access Level Modified · sigma-rule
• Google Workspace Government Attack Warning · sigma-rule
• Google Workspace Granted Domain API Access · sigma-rule
• Google Workspace User Granted Admin Privileges · sigma-rule
• Granting Of Permissions To An Account · sigma-rule
• Guest Account Enabled Via Sysadminctl · sigma-rule
• Guest User Invited By Non Approved Inviters · sigma-rule
• Guest Users Invited To Tenant By Non Approved Inviters · sigma-rule
• HackTool - CrackMapExec Execution · sigma-rule
• HackTool - CrackMapExec Execution Patterns · sigma-rule
• HackTool - Default PowerSploit/Empire Scheduled Task Creation · sigma-rule
• HackTool - Powerup Write Hijack DLL · sigma-rule
• HackTool - SharPersist Execution · sigma-rule
• HackTool - SharpUp PrivEsc Tool Execution · sigma-rule
• Hidden Local User Creation · sigma-rule
• HTTP Logging Disabled On IIS Server · sigma-rule
• Huawei BGP Authentication Failures · sigma-rule
• HybridConnectionManager Service Installation · sigma-rule
• HybridConnectionManager Service Running · sigma-rule
• IE Change Domain Zone · sigma-rule
• IIS Native-Code Module Command Line Installation · sigma-rule
• Important Scheduled Task Deleted/Disabled · sigma-rule
• Imports Registry Key From a File · sigma-rule
• Imports Registry Key From an ADS · sigma-rule
• Impossible Travel · sigma-rule
• Increased Failed Authentications Of Any Type · sigma-rule
• Interactive AT Job · sigma-rule
• Internet Explorer Autorun Keys Modification · sigma-rule
• Invalid PIM License · sigma-rule
• Juniper BGP Missing MD5 · sigma-rule
• KrbRelayUp Service Installation · sigma-rule
• Kubernetes Admission Controller Modification · sigma-rule
• Launch Agent/Daemon Execution Via Launchctl · sigma-rule
• Linux Setgid Capability Set on a Binary via Setcap Utility · sigma-rule
• Linux Setuid Capability Set on a Binary via Setcap Utility · sigma-rule
• Linux Webshell Indicators · sigma-rule
• Loading of Kernel Module via Insmod · sigma-rule
• Local User Creation · sigma-rule
• Login to Disabled Account · sigma-rule
• Logon from a Risky IP Address · sigma-rule
• MacOS Emond Launch Daemon · sigma-rule
• Macro Enabled In A Potentially Suspicious Document · sigma-rule
• Mailbox Export to Exchange Webserver · sigma-rule
• Malicious DLL File Dropped in the Teams or OneDrive Folder · sigma-rule
• Malicious Driver Load · sigma-rule
• Malicious Driver Load By Name · sigma-rule
• Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure · sigma-rule
• Manipulation of User Computer or Group Security Principals Across AD · sigma-rule
• Mask System Power Settings Via Systemctl · sigma-rule
• Measurable Increase Of Successful Authentications · sigma-rule
• Microsoft 365 - Impossible Travel Activity · sigma-rule
• Microsoft Defender Blocked from Loading Unsigned DLL · sigma-rule
• Microsoft Office DLL Sideload · sigma-rule
• MITRE BZAR Indicators for Execution · sigma-rule
• MITRE BZAR Indicators for Persistence · sigma-rule
• Modification of IE Registry Settings · sigma-rule
• Modification of ld.so.preload · sigma-rule
• Modify User Shell Folders Startup Value · sigma-rule
• Modifying Crontab · sigma-rule
• Monitoring For Persistence Via BITS · sigma-rule
• Moriya Rootkit - System · sigma-rule
• MSExchange Transport Agent Installation · sigma-rule
• MSExchange Transport Agent Installation - Builtin · sigma-rule
• Multifactor Authentication Denied · sigma-rule
• Multifactor Authentication Interrupted · sigma-rule
• Narrator's Feedback-Hub Persistence · sigma-rule
• NET NGenAssemblyUsageLog Registry Key Tamper · sigma-rule
• NetNTLM Downgrade Attack · sigma-rule
• NetNTLM Downgrade Attack - Registry · sigma-rule
• New BgInfo.EXE Custom DB Path Registry Configuration · sigma-rule
• New BgInfo.EXE Custom VBScript Registry Configuration · sigma-rule
• New BgInfo.EXE Custom WMI Query Registry Configuration · sigma-rule
• New BITS Job Created Via Bitsadmin · sigma-rule
• New BITS Job Created Via PowerShell · sigma-rule
• New Country · sigma-rule
• New Cron File Created · sigma-rule
• New Custom Shim Database Created · sigma-rule
• New DLL Added to AppCertDlls Registry Key · sigma-rule
• New DLL Added to AppInit_DLLs Registry Key · sigma-rule
• New DMSA Service Account Created in Specific OUs · sigma-rule
• New DNS ServerLevelPluginDll Installed · sigma-rule
• New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE · sigma-rule
• New Federated Domain Added - Exchange · sigma-rule
• New Github Organization Member Added · sigma-rule
• New Kernel Driver Via SC.EXE · sigma-rule
• New Kubernetes Service Account Created · sigma-rule
• New Module Module Added To IIS Server · sigma-rule
• New Netsh Helper DLL Registered From A Suspicious Location · sigma-rule
• New Outlook Macro Created · sigma-rule
• New PDQDeploy Service - Client Side · sigma-rule
• New PDQDeploy Service - Server Side · sigma-rule
• New Root Certificate Authority Added · sigma-rule
• New RUN Key Pointing to Suspicious Folder · sigma-rule
• New Service Creation Using PowerShell · sigma-rule
• New Service Creation Using Sc.EXE · sigma-rule
• New TimeProviders Registered With Uncommon DLL Name · sigma-rule
• New User Created Via Net.EXE · sigma-rule
• New User Created Via Net.EXE With Never Expire Option · sigma-rule
• NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE · sigma-rule
• Non-privileged Usage of Reg or Powershell · sigma-rule
• Number Of Resource Creation Or Deployment Activities · sigma-rule
• Office Application Startup - Office Test · sigma-rule
• Office Autorun Keys Modification · sigma-rule
• Office Macros Warning Disabled · sigma-rule
• Okta Admin Role Assigned to an User or Group · sigma-rule
• Okta Identity Provider Created · sigma-rule
• Okta MFA Reset or Deactivated · sigma-rule
• Okta New Admin Console Behaviours · sigma-rule
• OpenCanary - RDP New Connection Attempt · sigma-rule
• OpenCanary - SSH Login Attempt · sigma-rule
• OpenCanary - SSH New Connection Attempt · sigma-rule
• OpenCanary - Telnet Login Attempt · sigma-rule
• Outlook EnableUnsafeClientMailRules Setting Enabled - Registry · sigma-rule
• Outlook Macro Execution Without Warning Setting Enabled · sigma-rule
• Outlook Security Settings Updated - Registry · sigma-rule
• Password Change on Directory Service Restore Mode (DSRM) Account · sigma-rule
• Password Provided In Command Line Of Net.EXE · sigma-rule
• Password Reset By User Account · sigma-rule
• Password Set to Never Expire via WMI · sigma-rule
• Path To Screensaver Binary Modified · sigma-rule
• Persistence and Execution at Scale via GPO Scheduled Task · sigma-rule
• Persistence Via New SIP Provider · sigma-rule
• Persistence Via Sticky Key Backdoor · sigma-rule
• Persistence Via Sudoers.d Files · sigma-rule
• PIM Alert Setting Changes To Disabled · sigma-rule
• PIM Approvals And Deny Elevation · sigma-rule
• Possible Privilege Escalation via Weak Service Permissions · sigma-rule
• Possible Shadow Credentials Added · sigma-rule
• Potential 7za.DLL Sideloading · sigma-rule
• Potential Amazon SSM Agent Hijacking · sigma-rule
• Potential Antivirus Software DLL Sideloading · sigma-rule
• Potential appverifUI.DLL Sideloading · sigma-rule
• Potential AVKkid.DLL Sideloading · sigma-rule
• Potential Azure Browser SSO Abuse · sigma-rule
• Potential CCleanerDU.DLL Sideloading · sigma-rule
• Potential CCleanerReactivator.DLL Sideloading · sigma-rule
• Potential Chrome Frame Helper DLL Sideloading · sigma-rule
• Potential CobaltStrike Service Installations - Registry · sigma-rule
• Potential COM Object Hijacking Via TreatAs Subkey - Registry · sigma-rule
• Potential DLL Sideloading Of DBGCORE.DLL · sigma-rule
• Potential DLL Sideloading Of DBGHELP.DLL · sigma-rule
• Potential DLL Sideloading Of DbgModel.DLL · sigma-rule
• Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE · sigma-rule
• Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE · sigma-rule
• Potential DLL Sideloading Of MpSvc.DLL · sigma-rule
• Potential DLL Sideloading Of MsCorSvc.DLL · sigma-rule
• Potential DLL Sideloading Of Non-Existent DLLs From System Folders · sigma-rule
• Potential DLL Sideloading Via ClassicExplorer32.dll · sigma-rule
• Potential DLL Sideloading Via comctl32.dll · sigma-rule
• Potential DLL Sideloading Via DeviceEnroller.EXE · sigma-rule
• Potential DLL Sideloading Via JsSchHlp · sigma-rule
• Potential DLL Sideloading Via VMware Xfer · sigma-rule
• Potential EACore.DLL Sideloading · sigma-rule
• Potential Edputil.DLL Sideloading · sigma-rule
• Potential Goopdate.DLL Sideloading · sigma-rule
• Potential Initial Access via DLL Search Order Hijacking · sigma-rule
• Potential Iviewers.DLL Sideloading · sigma-rule
• Potential JLI.dll Side-Loading · sigma-rule
• Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation · sigma-rule
• Potential Libvlc.DLL Sideloading · sigma-rule
• Potential Linux Amazon SSM Agent Hijacking · sigma-rule
• Potential MFA Bypass Using Legacy Client Authentication · sigma-rule
• Potential Mfdetours.DLL Sideloading · sigma-rule
• Potential Mpclient.DLL Sideloading · sigma-rule
• Potential Mpclient.DLL Sideloading Via Defender Binaries · sigma-rule
• Potential Persistence Attempt Via Existing Service Tampering · sigma-rule
• Potential Persistence Attempt Via Run Keys Using Reg.EXE · sigma-rule
• Potential Persistence Using DebugPath · sigma-rule
• Potential Persistence Via App Paths Default Property · sigma-rule
• Potential Persistence Via AppCompat RegisterAppRestart Layer · sigma-rule
• Potential Persistence Via Custom Protocol Handler · sigma-rule
• Potential Persistence Via Event Viewer Events.asp · sigma-rule
• Potential Persistence Via Excel Add-in - Registry · sigma-rule
• Potential Persistence Via GlobalFlags · sigma-rule
• Potential Persistence Via Logon Scripts - CommandLine · sigma-rule
• Potential Persistence Via Logon Scripts - Registry · sigma-rule
• Potential Persistence Via Microsoft Compatibility Appraiser · sigma-rule
• Potential Persistence Via Microsoft Office Add-In · sigma-rule
• Potential Persistence Via Microsoft Office Startup Folder · sigma-rule
• Potential Persistence Via Netsh Helper DLL · sigma-rule
• Potential Persistence Via Netsh Helper DLL - Registry · sigma-rule
• Potential Persistence Via Outlook Form · sigma-rule
• Potential Persistence Via Outlook Home Page · sigma-rule
• Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting · sigma-rule
• Potential Persistence Via Outlook Today Page · sigma-rule
• Potential Persistence Via PlistBuddy · sigma-rule
• Potential Persistence Via Powershell Search Order Hijacking - Task · sigma-rule
• Potential Persistence Via PowerShell User Profile Using Add-Content · sigma-rule
• Potential Persistence Via Scrobj.dll COM Hijacking · sigma-rule
• Potential Persistence Via Shim Database In Uncommon Location · sigma-rule
• Potential Persistence Via Shim Database Modification · sigma-rule
• Potential Persistence Via Visual Studio Tools for Office · sigma-rule
• Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · sigma-rule
• Potential Privilege Escalation Using Symlink Between Osk and Cmd · sigma-rule
• Potential Privilege Escalation via Service Permissions Weakness · sigma-rule
• Potential PSFactoryBuffer COM Hijacking · sigma-rule
• Potential Python DLL SideLoading · sigma-rule
• Potential Qakbot Registry Activity · sigma-rule
• Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE · sigma-rule
• Potential Rcdll.DLL Sideloading · sigma-rule
• Potential Registry Persistence Attempt Via DbgManagedDebugger · sigma-rule
• Potential Registry Persistence Attempt Via Windows Telemetry · sigma-rule
• Potential RipZip Attack on Startup Folder · sigma-rule
• Potential RjvPlatform.DLL Sideloading From Default Location · sigma-rule
• Potential RjvPlatform.DLL Sideloading From Non-Default Location · sigma-rule
• Potential RoboForm.DLL Sideloading · sigma-rule
• Potential ShellDispatch.DLL Sideloading · sigma-rule
• Potential Shim Database Persistence via Sdbinst.EXE · sigma-rule
• Potential SmadHook.DLL Sideloading · sigma-rule
• Potential SolidPDFCreator.DLL Sideloading · sigma-rule
• Potential SSH Tunnel Persistence Install Using A Scheduled Task · sigma-rule
• Potential Startup Shortcut Persistence Via PowerShell.EXE · sigma-rule
• Potential Suspicious Activity Using SeCEdit · sigma-rule
• Potential Suspicious Registry File Imported Via Reg.EXE · sigma-rule
• Potential System DLL Sideloading From Non System Locations · sigma-rule
• Potential Tampering With RDP Related Registry Keys Via Reg.EXE · sigma-rule
• Potential Vcruntime140 DLL Sideloading · sigma-rule
• Potential Vivaldi_elf.DLL Sideloading · sigma-rule
• Potential Waveedit.DLL Sideloading · sigma-rule
• Potential Wazuh Security Platform DLL Sideloading · sigma-rule
• Potential Webshell Creation On Static Website · sigma-rule
• Potential WWlib.DLL Sideloading · sigma-rule
• Potentially Suspicious Child Process of KeyScrambler.exe · sigma-rule
• Potentially Suspicious Desktop Background Change Using Reg.EXE · sigma-rule
• Potentially Suspicious Desktop Background Change Via Registry · sigma-rule
• Potentially Suspicious Malware Callback Communication · sigma-rule
• Potentially Suspicious Malware Callback Communication - Linux · sigma-rule
• Potentially Suspicious ODBC Driver Registered · sigma-rule
• PowerShell Create Local User · sigma-rule
• Powershell Create Scheduled Task · sigma-rule
• Powershell Install a DLL in System Directory · sigma-rule
• Powershell LocalAccount Manipulation · sigma-rule
• PowerShell Logging Disabled Via Registry Key Tampering · sigma-rule
• PowerShell Profile Modification · sigma-rule
• PowerShell Web Access Feature Enabled Via DISM · sigma-rule
• PowerShell Web Access Installation - PsScript · sigma-rule
• Powershell WMI Persistence · sigma-rule
• Powerview Add-DomainObjectAcl DCSync AD Extend Right · sigma-rule
• Previously Installed IIS Module Was Removed · sigma-rule
• Privileged Account Creation · sigma-rule
• Privileged User Has Been Created · sigma-rule
• Process Explorer Driver Creation By Non-Sysinternals Binary · sigma-rule
• Process Monitor Driver Creation By Non-Sysinternals Binary · sigma-rule
• ProcessHacker Privilege Elevation · sigma-rule
• PSEXEC Remote Execution File Artefact · sigma-rule
• PUA - Kernel Driver Utility (KDU) Execution · sigma-rule
• PUA - Process Hacker Driver Load · sigma-rule
• PUA - Process Hacker Execution · sigma-rule
• PUA - System Informer Driver Load · sigma-rule
• PUA - System Informer Execution · sigma-rule
• RDP Sensitive Settings Changed · sigma-rule
• RDP Sensitive Settings Changed to Zero · sigma-rule
• RedMimicry Winnti Playbook Registry Manipulation · sigma-rule
• Reg Add Suspicious Paths · sigma-rule
• Registry Entries For Azorult Malware · sigma-rule
• Registry Explorer Policy Modification · sigma-rule
• Registry Hide Function from User · sigma-rule
• Registry Manipulation via WMI Stdregprov · sigma-rule
• Registry Modification Attempt Via VBScript · sigma-rule
• Registry Modification Attempt Via VBScript - PowerShell · sigma-rule
• Registry Modification for OCI DLL Redirection · sigma-rule
• Registry Modification of MS-settings Protocol Handler · sigma-rule
• Registry Modification to Hidden File Extension · sigma-rule
• Registry Modification Via Regini.EXE · sigma-rule
• Registry Persistence Mechanisms in Recycle Bin · sigma-rule
• Registry Persistence via Explorer Run Key · sigma-rule
• Registry Tampering by Potentially Suspicious Processes · sigma-rule
• Registry-Free Process Scope COR_PROFILER · sigma-rule
• Regsvr32 DLL Execution With Uncommon Extension · sigma-rule
• Remote Access Tool - AnyDesk Incoming Connection · sigma-rule
• Remote Access Tool - ScreenConnect Installation Execution · sigma-rule
• Remote Access Tool - Team Viewer Session Started On Linux Host · sigma-rule
• Remote Access Tool - Team Viewer Session Started On MacOS Host · sigma-rule
• Remote Access Tool - Team Viewer Session Started On Windows Host · sigma-rule
• Remote Access Tool Services Have Been Installed - Security · sigma-rule
• Remote Access Tool Services Have Been Installed - System · sigma-rule
• Remote Registry Lateral Movement · sigma-rule
• Remote Schedule Task Lateral Movement via ATSvc · sigma-rule
• Remote Schedule Task Lateral Movement via ITaskSchedulerService · sigma-rule
• Remote Schedule Task Lateral Movement via SASec · sigma-rule
• Remote Service Activity via SVCCTL Named Pipe · sigma-rule
• Remote Task Creation via ATSVC Named Pipe · sigma-rule
• Remote Task Creation via ATSVC Named Pipe - Zeek · sigma-rule
• Removal of Potential COM Hijacking Registry Keys · sigma-rule
• Renamed Schtasks Execution · sigma-rule
• Renamed Vmnat.exe Execution · sigma-rule
• RestrictedAdminMode Registry Value Tampering · sigma-rule
• RestrictedAdminMode Registry Value Tampering - ProcCreation · sigma-rule
• Roles Activated Too Frequently · sigma-rule
• Roles Activation Doesn't Require MFA · sigma-rule
• Roles Are Not Being Used · sigma-rule
• Roles Assigned Outside PIM · sigma-rule
• Root Account Enable Via Dsenableroot · sigma-rule
• Run Once Task Configuration in Registry · sigma-rule
• Run Once Task Execution as Configured in Registry · sigma-rule
• Rundll32 Registered COM Objects · sigma-rule
• Running Chrome VPN Extensions via the Registry 2 VPN Extension · sigma-rule
• Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE · sigma-rule
• Scheduled Cron Task/Job - Linux · sigma-rule
• Scheduled Cron Task/Job - MacOs · sigma-rule
• Scheduled Task Creation Masquerading as System Processes · sigma-rule
• Scheduled Task Creation Via Schtasks.EXE · sigma-rule
• Scheduled Task Creation with Curl and PowerShell Execution Combo · sigma-rule
• Scheduled Task Executed From A Suspicious Location · sigma-rule
• Scheduled Task Executed Uncommon LOLBIN · sigma-rule
• Scheduled Task Executing Encoded Payload from Registry · sigma-rule
• Scheduled Task Executing Payload from Registry · sigma-rule
• Scheduled Task/Job At · sigma-rule
• Scheduled TaskCache Change by Uncommon Program · sigma-rule
• Schtasks Creation Or Modification With SYSTEM Privileges · sigma-rule
• Schtasks From Suspicious Folders · sigma-rule
• Security Event Logging Disabled via MiniNt Registry Key - Process · sigma-rule
• Security Event Logging Disabled via MiniNt Registry Key - Registry Set · sigma-rule
• Security Support Provider (SSP) Added to LSA Configuration · sigma-rule
• Service Binary in Suspicious Folder · sigma-rule
• Service DACL Abuse To Hide Services Via Sc.EXE · sigma-rule
• Service Installation in Suspicious Folder · sigma-rule
• Service Installation with Suspicious Folder Pattern · sigma-rule
• Service Installed By Unusual Client - Security · sigma-rule
• Service Installed By Unusual Client - System · sigma-rule
• Service Registry Key Read Access Request · sigma-rule
• Service Registry Permissions Weakness Check · sigma-rule
• Service Reload or Start - Linux · sigma-rule
• Service Security Descriptor Tampering Via Sc.EXE · sigma-rule
• ServiceDll Hijack · sigma-rule
• Session Manager Autorun Keys Modification · sigma-rule
• Setuid and Setgid · sigma-rule
• Setup16.EXE Execution With Custom .Lst File · sigma-rule
• Shell Open Registry Keys Manipulation · sigma-rule
• Shellshock Expression · sigma-rule
• ShimCache Flush · sigma-rule
• Sign-in Failure Due to Conditional Access Requirements Not Met · sigma-rule
• Sign-ins by Unknown Devices · sigma-rule
• Sign-ins from Non-Compliant Devices · sigma-rule
• Sliver C2 Default Service Installation · sigma-rule
• Special File Creation via Mknod Syscall · sigma-rule
• Stale Accounts In A Privileged Role · sigma-rule
• Startup Folder File Write · sigma-rule
• Startup Item File Created - MacOS · sigma-rule
• Startup/Logon Script Added to Group Policy Object · sigma-rule
• Sticky Key Like Backdoor Execution · sigma-rule
• Sticky Key Like Backdoor Usage - Registry · sigma-rule
• Successful Authentications From Countries You Do Not Operate Out Of · sigma-rule
• Suspicious ASPX File Drop by Exchange · sigma-rule
• Suspicious Autorun Registry Modified via WMI · sigma-rule
• Suspicious Browser Activity · sigma-rule
• Suspicious Child Process Of SQL Server · sigma-rule
• Suspicious Chromium Browser Instance Executed With Custom Extension · sigma-rule
• Suspicious Command Patterns In Scheduled Task Creation · sigma-rule
• Suspicious Computer Machine Password by PowerShell · sigma-rule
• Suspicious Debugger Registration Cmdline · sigma-rule
• Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing · sigma-rule
• Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network · sigma-rule
• Suspicious Download From Direct IP Via Bitsadmin · sigma-rule
• Suspicious Download From File-Sharing Website Via Bitsadmin · sigma-rule
• Suspicious Driver Install by pnputil.exe · sigma-rule
• Suspicious Encoded Scripts in a WMI Consumer · sigma-rule
• Suspicious Execution via macOS Script Editor · sigma-rule
• Suspicious File Created by ArcSOC.exe · sigma-rule
• Suspicious File Drop by Exchange · sigma-rule
• Suspicious File Write to SharePoint Layouts Directory · sigma-rule
• Suspicious File Write to Webapps Root Directory · sigma-rule
• Suspicious Get-Variable.exe Creation · sigma-rule
• Suspicious GetTypeFromCLSID ShellExecute · sigma-rule
• Suspicious GrpConv Execution · sigma-rule
• Suspicious GUP Usage · sigma-rule
• Suspicious IIS Module Registration · sigma-rule
• Suspicious Login Activity Classified By Google · sigma-rule
• Suspicious Microsoft Office Child Process - MacOS · sigma-rule
• Suspicious Modification Of Scheduled Tasks · sigma-rule
• Suspicious MSExchangeMailboxReplication ASPX Write · sigma-rule
• Suspicious New Service Creation · sigma-rule
• Suspicious Outlook Macro Created · sigma-rule
• Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · sigma-rule
• Suspicious PowerShell In Registry Run Keys · sigma-rule
• Suspicious Printer Driver Empty Manufacturer · sigma-rule
• Suspicious Process By Web Server Process · sigma-rule
• Suspicious Processes Spawned by WinRM · sigma-rule
• Suspicious Registry Modification From ADS Via Regini.EXE · sigma-rule
• Suspicious Remote Logon with Explicit Credentials · sigma-rule
• Suspicious Run Key from Download · sigma-rule
• Suspicious Scheduled Task Creation · sigma-rule
• Suspicious Scheduled Task Creation Involving Temp Folder · sigma-rule
• Suspicious Scheduled Task Creation via Masqueraded XML File · sigma-rule
• Suspicious Scheduled Task Name As GUID · sigma-rule
• Suspicious Scheduled Task Update · sigma-rule
• Suspicious Scheduled Task Write to System32 Tasks · sigma-rule
• Suspicious Schtasks Execution AppData Folder · sigma-rule
• Suspicious Schtasks Schedule Type With High Privileges · sigma-rule
• Suspicious Schtasks Schedule Types · sigma-rule
• Suspicious ScreenSave Change by Reg.exe · sigma-rule
• Suspicious Screensaver Binary File Creation · sigma-rule
• Suspicious Service DACL Modification Via Set-Service Cmdlet · sigma-rule
• Suspicious Service DACL Modification Via Set-Service Cmdlet - PS · sigma-rule
• Suspicious Service Installation · sigma-rule
• Suspicious Service Installation Script · sigma-rule
• Suspicious Service Path Modification · sigma-rule
• Suspicious Shell Open Command Registry Modification · sigma-rule
• Suspicious Shim Database Patching Activity · sigma-rule
• Suspicious SignIns From A Non Registered Device · sigma-rule
• Suspicious SQL Query · sigma-rule
• Suspicious Startup Folder Persistence · sigma-rule
• Suspicious Unsigned Thor Scanner Execution · sigma-rule
• Suspicious VBoxDrvInst.exe Parameters · sigma-rule
• Suspicious Velociraptor Child Process · sigma-rule
• Suspicious Windows ANONYMOUS LOGON Local Account Created · sigma-rule
• Suspicious Windows Strings In URI · sigma-rule
• Sysinternals PsService Execution · sigma-rule
• Sysinternals PsSuspend Execution · sigma-rule
• Sysmon Channel Reference Deletion · sigma-rule
• System Control Panel Item Loaded From Uncommon Location · sigma-rule
• System Scripts Autorun Keys Modification · sigma-rule
• Systemd Service Creation · sigma-rule
• Tasks Folder Evasion · sigma-rule
• Temporary Access Pass Added To An Account · sigma-rule
• Terminal Server Client Connection History Cleared - Registry · sigma-rule
• Third Party Software DLL Sideloading · sigma-rule
• Too Many Global Admins · sigma-rule
• Triple Cross eBPF Rootkit Default Persistence · sigma-rule
• Trust Access Disable For VBApplications · sigma-rule
• Trusted Path Bypass via Windows Directory Spoofing · sigma-rule
• UAC Bypass With Fake DLL · sigma-rule
• UEFI Persistence Via Wpbbin - FileCreation · sigma-rule
• UEFI Persistence Via Wpbbin - ProcessCreation · sigma-rule
• Uncommon Extension Shim Database Installation Via Sdbinst.EXE · sigma-rule
• Uncommon Microsoft Office Trusted Location Added · sigma-rule
• Uncommon One Time Only Scheduled Task At 00:00 · sigma-rule
• Uncommon Service Installation Image Path · sigma-rule
• Uncommon Userinit Child Process · sigma-rule
• Unfamiliar Sign-In Properties · sigma-rule
• Unix Shell Configuration Modification · sigma-rule
• Unsigned .node File Loaded · sigma-rule
• Unsigned Binary Loaded From Suspicious Location · sigma-rule
• Unsigned Mfdetours.DLL Sideloading · sigma-rule
• Unsigned Module Loaded by ClickOnce Application · sigma-rule
• Unusual Child Process of dns.exe · sigma-rule
• Unusual File Deletion by Dns.exe · sigma-rule
• Unusual File Modification by dns.exe · sigma-rule
• Use Of Hidden Paths Or Files · sigma-rule
• Use of Legacy Authentication Protocols · sigma-rule
• User Access Blocked by Azure Conditional Access · sigma-rule
• User Added To Admin Group Via Dscl · sigma-rule
• User Added To Admin Group Via DseditGroup · sigma-rule
• User Added To Admin Group Via Sysadminctl · sigma-rule
• User Added to an Administrator's Azure AD Role · sigma-rule
• User Added To Group With CA Policy Modification Access · sigma-rule
• User Added To Highly Privileged Group · sigma-rule
• User Added to Local Administrator Group · sigma-rule
• User Added to Local Administrators Group · sigma-rule
• User Added To Privilege Role · sigma-rule
• User Added to Remote Desktop Users Group · sigma-rule
• User Removed From Group With CA Policy Modification Access · sigma-rule
• User Shell Folders Registry Modification via CommandLine · sigma-rule
• User State Changed From Guest To Member · sigma-rule
• Users Added to Global or Device Admin Roles · sigma-rule
• Users Authenticating To Other Azure AD Tenants · sigma-rule
• Using SettingSyncHost.exe as LOLBin · sigma-rule
• VBScript Payload Stored in Registry · sigma-rule
• VMGuestLib DLL Sideload · sigma-rule
• VMMap Signed Dbghelp.DLL Potential Sideloading · sigma-rule
• VMMap Unsigned Dbghelp.DLL Potential Sideloading · sigma-rule
• VMToolsd Suspicious Child Process · sigma-rule
• VsCode Powershell Profile Modification · sigma-rule
• Vulnerable Driver Load · sigma-rule
• Vulnerable Driver Load By Name · sigma-rule
• Vulnerable HackSys Extreme Vulnerable Driver Load · sigma-rule
• Vulnerable WinRing0 Driver Load · sigma-rule
• Wdigest CredGuard Registry Modification · sigma-rule
• Wdigest Enable UseLogonCredential · sigma-rule
• Webshell Detection With Command Line Keywords · sigma-rule
• Webshell Hacking Activity Patterns · sigma-rule
• Webshell ReGeorg Detection Via Web Logs · sigma-rule
• Webshell Remote Command Execution · sigma-rule
• Webshell Tool Reconnaissance Activity · sigma-rule
• Win Susp Computer Name Containing Samtheadmin · sigma-rule
• Windows Event Log Access Tampering Via Registry · sigma-rule
• Windows LAPS Credential Dump From Entra ID · sigma-rule
• Windows Network Access Suspicious desktop.ini Action · sigma-rule
• Windows Terminal Profile Settings Modification By Uncommon Process · sigma-rule
• Windows Webshell Strings · sigma-rule
• WINEKEY Registry Modification · sigma-rule
• Winlogon AllowMultipleTSSessions Enable · sigma-rule
• Winlogon Helper DLL · sigma-rule
• Winlogon Notify Key Logon Persistence · sigma-rule
• WinRAR Creating Files in Startup Locations · sigma-rule
• WinSock2 Autorun Keys Modification · sigma-rule
• WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load · sigma-rule
• WMI Backdoor Exchange Transport Agent · sigma-rule
• WMI Event Subscription · sigma-rule
• WMI Persistence · sigma-rule
• WMI Persistence - Command Line Event Consumer · sigma-rule
• WMI Persistence - Script Event Consumer · sigma-rule
• WMI Persistence - Script Event Consumer File Write · sigma-rule
• WMI Persistence - Security · sigma-rule
• Wow6432Node Classes Autorun Keys Modification · sigma-rule
• Wow6432Node CurrentVersion Autorun Keys Modification · sigma-rule
• Wow6432Node Windows NT CurrentVersion Autorun Keys Modification · sigma-rule
• Writing Local Admin Share · sigma-rule
• Writing Of Malicious Files To The Fonts Folder · sigma-rule
• Xwizard.EXE Execution From Non-Default Location · sigma-rule