attack.t1098 — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• A Member Was Added to a Security-Enabled Global Group · sigma-rule
• A Member Was Removed From a Security-Enabled Global Group · sigma-rule
• A New Trust Was Created To A Domain · sigma-rule
• A Security-Enabled Global Group Was Deleted · sigma-rule
• Active Directory User Backdoors · sigma-rule
• Anomalous User Activity · sigma-rule
• AWS IAM Backdoor Users Keys · sigma-rule
• AWS Route 53 Domain Transfer Lock Disabled · sigma-rule
• AWS Route 53 Domain Transferred to Another Account · sigma-rule
• AWS User Login Profile Was Modified · sigma-rule
• Bitbucket Global Permission Changed · sigma-rule
• Bulk Deletion Changes To Privileged Account Permissions · sigma-rule
• Change to Authentication Method · sigma-rule
• Cisco Local Accounts · sigma-rule
• DMSA Link Attributes Modified · sigma-rule
• DMSA Service Account Created in Specific OUs - PowerShell · sigma-rule
• Enabled User Right in AD to Control User Objects · sigma-rule
• ESXi Admin Permission Assigned To Account Via ESXCLI · sigma-rule
• GCP Access Policy Deleted · sigma-rule
• Google Workspace Granted Domain API Access · sigma-rule
• Google Workspace User Granted Admin Privileges · sigma-rule
• New DMSA Service Account Created in Specific OUs · sigma-rule
• Number Of Resource Creation Or Deployment Activities · sigma-rule
• Password Change on Directory Service Restore Mode (DSRM) Account · sigma-rule
• Password Set to Never Expire via WMI · sigma-rule
• Powershell LocalAccount Manipulation · sigma-rule
• Powerview Add-DomainObjectAcl DCSync AD Extend Right · sigma-rule
• Privileged User Has Been Created · sigma-rule
• User Added To Highly Privileged Group · sigma-rule
• User Added to Local Administrator Group · sigma-rule
• User Added to Local Administrators Group · sigma-rule