attack.t1059 — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Abusable DLL Potential Sideloading From Suspicious Location · sigma-rule
• Add Insecure Download Source To Winget · sigma-rule
• Add New Download Source To Winget · sigma-rule
• Add Potential Suspicious New Download Source To Winget · sigma-rule
• Azure New CloudShell Created · sigma-rule
• BPFDoor Abnormal Process ID or Lock File Accessed · sigma-rule
• Capsh Shell Invocation - Linux · sigma-rule
• Clfs.SYS Loaded By Process Located In a Potential Suspicious Location · sigma-rule
• Conhost Spawned By Uncommon Parent Process · sigma-rule
• Deno Runtime Spawns Shell Or Scripting Interpreter · sigma-rule
• Elevated System Shell Spawned From Uncommon Parent Location · sigma-rule
• Forfiles Command Execution · sigma-rule
• HackTool - Sliver C2 Implant Activity Pattern · sigma-rule
• HackTool - Stracciatella Execution · sigma-rule
• Hacktool Ruler · sigma-rule
• Inline Python Execution - Spawn Shell Via OS System Library · sigma-rule
• Install New Package Via Winget Local Manifest · sigma-rule
• Installation of WSL Kali-Linux · sigma-rule
• Outlook EnableUnsafeClientMailRules Setting Enabled · sigma-rule
• Payload Decoded and Decrypted via Built-in Utilities · sigma-rule
• PCRE.NET Package Image Load · sigma-rule
• PCRE.NET Package Temp Files · sigma-rule
• Perl Inline Command Execution · sigma-rule
• Php Inline Command Execution · sigma-rule
• Potential Arbitrary Command Execution Via FTP.EXE · sigma-rule
• Potential CobaltStrike Process Patterns · sigma-rule
• Potential Dosfuscation Activity · sigma-rule
• Potential Netcat Reverse Shell Execution · sigma-rule
• Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · sigma-rule
• Potential Xterm Reverse Shell · sigma-rule
• Potentially Suspicious Execution From Parent Process In Public Folder · sigma-rule
• Potentially Suspicious NTFS Symlink Behavior Modification · sigma-rule
• PowerShell Download and Execution Cradles · sigma-rule
• PUA - Wsudo Suspicious Execution · sigma-rule
• Python Inline Command Execution · sigma-rule
• Python Spawning Pretty TTY on Windows · sigma-rule
• Python Spawning Pretty TTY Via PTY Module · sigma-rule
• Renamed CURL.EXE Execution · sigma-rule
• Renamed FTP.EXE Execution · sigma-rule
• Renamed NirCmd.EXE Execution · sigma-rule
• Renamed PingCastle Binary Execution · sigma-rule
• Ruby Inline Command Execution · sigma-rule
• Run PowerShell Script from Redirected Input Stream · sigma-rule
• Script Interpreter Execution From Suspicious Folder · sigma-rule
• Shell Execution via Git - Linux · sigma-rule
• Shell Execution via Rsync - Linux · sigma-rule
• Shell Invocation Via Ssh - Linux · sigma-rule
• Suspicious ArcSOC.exe Child Process · sigma-rule
• Suspicious Browser Child Process - MacOS · sigma-rule
• Suspicious Execution via macOS Script Editor · sigma-rule
• Suspicious File Created In PerfLogs · sigma-rule
• Suspicious Greedy Compression Using Rar.EXE · sigma-rule
• Suspicious Installer Package Child Process · sigma-rule
• Suspicious Invocation of Shell via AWK - Linux · sigma-rule
• Suspicious Invocation of Shell via Rsync · sigma-rule
• Suspicious Java Children Processes · sigma-rule
• Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · sigma-rule
• Suspicious Program Names · sigma-rule
• Suspicious RASdial Activity · sigma-rule
• Suspicious Remote Child Process From Outlook · sigma-rule
• Suspicious Runscripthelper.exe · sigma-rule
• Suspicious Scan Loop Network · sigma-rule
• Sysprep on AppData Folder · sigma-rule
• Unusual Parent Process For Cmd.EXE · sigma-rule
• Use of FSharp Interpreters · sigma-rule
• Use of OpenConsole · sigma-rule
• Use of Pcalua For Execution · sigma-rule
• Vim GTFOBin Abuse - Linux · sigma-rule
• VMToolsd Suspicious Child Process · sigma-rule
• Windows Defender AMSI Trigger Detected · sigma-rule
• Windows Defender Exclusions Added - PowerShell · sigma-rule
• Windows Defender Threat Detected · sigma-rule
• Windows Shell/Scripting Application File Write to Suspicious Folder · sigma-rule
• Writing Of Malicious Files To The Fonts Folder · sigma-rule
• Wscript Shell Run In CommandLine · sigma-rule