1200KM / tag
attack.t1197 — sigma-tag tag
15 related reference pages for sigma-tag: attack.t1197.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- BITS Transfer Job Download From Direct IP · sigma-rule
- BITS Transfer Job Download From File Sharing Domains · sigma-rule
- BITS Transfer Job Download To Potential Suspicious Folder · sigma-rule
- BITS Transfer Job Downloading File Potential Suspicious Extension · sigma-rule
- BITS Transfer Job With Uncommon Or Suspicious Remote TLD · sigma-rule
- Bitsadmin to Uncommon IP Server Address · sigma-rule
- Bitsadmin to Uncommon TLD · sigma-rule
- File Download Via Bitsadmin · sigma-rule
- File Download Via Bitsadmin To A Suspicious Target Folder · sigma-rule
- File With Suspicious Extension Downloaded Via Bitsadmin · sigma-rule
- Monitoring For Persistence Via BITS · sigma-rule
- New BITS Job Created Via Bitsadmin · sigma-rule
- New BITS Job Created Via PowerShell · sigma-rule
- Suspicious Download From Direct IP Via Bitsadmin · sigma-rule
- Suspicious Download From File-Sharing Website Via Bitsadmin · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.