attack.t1033 — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Chopper Webshell Process Pattern · sigma-rule
• Cisco Discovery · sigma-rule
• Computer Discovery And Export Via Get-ADComputer Cmdlet · sigma-rule
• Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell · sigma-rule
• Enumerate All Information With Whoami.EXE · sigma-rule
• ESXi Network Configuration Discovery Via ESXCLI · sigma-rule
• ESXi Storage Information Discovery Via ESXCLI · sigma-rule
• ESXi System Information Discovery Via ESXCLI · sigma-rule
• ESXi VM List Discovery Via ESXCLI · sigma-rule
• ESXi VSAN Information Discovery Via ESXCLI · sigma-rule
• Get-ADUser Enumeration Using UserAccountControl Flags · sigma-rule
• Group Membership Reconnaissance Via Whoami.EXE · sigma-rule
• HackTool - SharpLdapWhoami Execution · sigma-rule
• HackTool - SharpView Execution · sigma-rule
• Local Accounts Discovery · sigma-rule
• Possible DCSync Attack · sigma-rule
• Renamed Whoami Execution · sigma-rule
• Security Privileges Enumeration Via Whoami.EXE · sigma-rule
• SharpHound Recon Sessions · sigma-rule
• Suspicious PowerShell Get Current User · sigma-rule
• System Owner or User Discovery - Linux · sigma-rule
• User Discovery And Export Via Get-ADUser Cmdlet · sigma-rule
• User Discovery And Export Via Get-ADUser Cmdlet - PowerShell · sigma-rule
• Webshell Detection With Command Line Keywords · sigma-rule
• Webshell Hacking Activity Patterns · sigma-rule
• WhoAmI as Parameter · sigma-rule
• Whoami.EXE Execution Anomaly · sigma-rule
• Whoami.EXE Execution From Privileged Process · sigma-rule
• Whoami.EXE Execution With Output Option · sigma-rule