attack.t1071.001 — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• APT User Agent · sigma-rule
• Bitsadmin to Uncommon IP Server Address · sigma-rule
• Bitsadmin to Uncommon TLD · sigma-rule
• Change User Agents with WebRequest · sigma-rule
• Cloudflared Tunnels Related DNS Requests · sigma-rule
• Crypto Miner User Agent · sigma-rule
• DNS Query Request By QuickAssist.EXE · sigma-rule
• DNS Query To Devtunnels Domain · sigma-rule
• DNS Query To Visual Studio Code Tunnels Domain · sigma-rule
• Exploit Framework User Agent · sigma-rule
• HackTool - BabyShark Agent Default URL Pattern · sigma-rule
• HackTool - CobaltStrike Malleable Profile Patterns - Proxy · sigma-rule
• HackTool - Empire UserAgent URI Combo · sigma-rule
• HTTP Request With Empty User Agent · sigma-rule
• Malware User Agent · sigma-rule
• Outbound Network Connection Initiated By Microsoft Dialer · sigma-rule
• Potential Base64 Encoded User-Agent · sigma-rule
• PwnDrp Access · sigma-rule
• Raw Paste Service Access · sigma-rule
• Renamed Visual Studio Code Tunnel Execution · sigma-rule
• Suspicious Base64 Encoded User-Agent · sigma-rule
• Suspicious Curl Change User Agents - Linux · sigma-rule
• Suspicious Installer Package Child Process · sigma-rule
• Suspicious User Agent · sigma-rule
• Telegram API Access · sigma-rule
• Visual Studio Code Tunnel Execution · sigma-rule
• Visual Studio Code Tunnel Service Installation · sigma-rule
• Visual Studio Code Tunnel Shell Execution · sigma-rule
• Wannacry Killswitch Domain · sigma-rule
• Windows PowerShell User Agent · sigma-rule
• Windows WebDAV User Agent · sigma-rule