attack.t1218 — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Abusing Print Executable · sigma-rule
• AddinUtil.EXE Execution From Uncommon Directory · sigma-rule
• AgentExecutor PowerShell Execution · sigma-rule
• Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE · sigma-rule
• Arbitrary File Download Via IMEWDBLD.EXE · sigma-rule
• Arbitrary File Download Via MSEDGE_PROXY.EXE · sigma-rule
• Arbitrary File Download Via MSOHTMED.EXE · sigma-rule
• Arbitrary File Download Via MSPUB.EXE · sigma-rule
• Arbitrary File Download Via PresentationHost.EXE · sigma-rule
• Arbitrary File Download Via Squirrel.EXE · sigma-rule
• Arbitrary MSI Download Via Devinit.EXE · sigma-rule
• Atbroker Registry Change · sigma-rule
• BaaUpdate.exe Suspicious DLL Load · sigma-rule
• Binary Proxy Execution Via Dotnet-Trace.EXE · sigma-rule
• BitLockerTogo.EXE Execution · sigma-rule
• COM Object Execution via Xwizard.EXE · sigma-rule
• Created Files by Microsoft Sync Center · sigma-rule
• Curl Download And Execute Combination · sigma-rule
• DeviceCredentialDeployment Execution · sigma-rule
• Devtoolslauncher.exe Executes Specified Binary · sigma-rule
• Diskshadow Script Mode - Execution From Potential Suspicious Location · sigma-rule
• Diskshadow Script Mode - Uncommon Script Extension Execution · sigma-rule
• DLL Execution via Rasautou.exe · sigma-rule
• DLL Loaded via CertOC.EXE · sigma-rule
• Execute Files with Msdeploy.exe · sigma-rule
• Execute Pcwrun.EXE To Leverage Follina · sigma-rule
• Execution DLL of Choice Using WAB.EXE · sigma-rule
• Execution via stordiag.exe · sigma-rule
• Execution via WorkFolders.exe · sigma-rule
• File Download Using ProtocolHandler.exe · sigma-rule
• File Download Via InstallUtil.EXE · sigma-rule
• File Download Via Windows Defender MpCmpRun.EXE · sigma-rule
• Gpscript Execution · sigma-rule
• Hidden Flag Set On File/Directory Via Chflags - MacOS · sigma-rule
• HTML Help HH.EXE Suspicious Child Process · sigma-rule
• Ie4uinit Lolbin Use From Invalid Path · sigma-rule
• Import LDAP Data Interchange Format File Via Ldifde.EXE · sigma-rule
• Indirect Command Execution By Program Compatibility Wizard · sigma-rule
• InfDefaultInstall.exe .inf Execution · sigma-rule
• Insensitive Subfolder Search Via Findstr.EXE · sigma-rule
• Legitimate Application Dropped Archive · sigma-rule
• Legitimate Application Dropped Executable · sigma-rule
• Legitimate Application Dropped Script · sigma-rule
• Legitimate Application Writing Files In Uncommon Location · sigma-rule
• Lolbin Runexehelper Use As Proxy · sigma-rule
• Lolbin Unregmp2.exe Use As Proxy · sigma-rule
• Malicious PE Execution by Microsoft Visual Studio Debugger · sigma-rule
• Malicious Windows Script Components File Execution by TAEF Detection · sigma-rule
• Microsoft Sync Center Suspicious Network Connections · sigma-rule
• MpiExec Lolbin · sigma-rule
• MSDT Execution Via Answer File · sigma-rule
• MSI Installation From Web · sigma-rule
• Network Connection Initiated By AddinUtil.EXE · sigma-rule
• New Capture Session Launched Via DXCap.EXE · sigma-rule
• OpenWith.exe Executes Specified Binary · sigma-rule
• Potential Application Whitelisting Bypass via Dnx.EXE · sigma-rule
• Potential Arbitrary File Download Via Cmdl32.EXE · sigma-rule
• Potential Binary Impersonating Sysinternals Tools · sigma-rule
• Potential Binary Proxy Execution Via Cdb.EXE · sigma-rule
• Potential Binary Proxy Execution Via VSDiagnostics.EXE · sigma-rule
• Potential DLL Sideloading Using Coregen.exe · sigma-rule
• Potential File Download Via MS-AppInstaller Protocol Handler · sigma-rule
• Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution · sigma-rule
• Potential NTLM Coercion Via Certutil.EXE · sigma-rule
• Potential Password Spraying Attempt Using Dsacls.EXE · sigma-rule
• Potential Provisioning Registry Key Abuse For Binary Proxy Execution · sigma-rule
• Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG · sigma-rule
• Potential Provlaunch.EXE Binary Proxy Execution Abuse · sigma-rule
• Potential Register_App.Vbs LOLScript Abuse · sigma-rule
• Potential RemoteFXvGPUDisablement.EXE Abuse · sigma-rule
• Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module · sigma-rule
• Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock · sigma-rule
• Potential Suspicious Mofcomp Execution · sigma-rule
• Potentially Over Permissive Permissions Granted Using Dsacls.EXE · sigma-rule
• Potentially Suspicious Cabinet File Expansion · sigma-rule
• Potentially Suspicious Child Process Of DiskShadow.EXE · sigma-rule
• Potentially Suspicious Child Process Of VsCode · sigma-rule
• Potentially Suspicious Child Processes Spawned by ConHost · sigma-rule
• Potentially Suspicious CMD Shell Output Redirect · sigma-rule
• Potentially Suspicious Self Extraction Directive File Created · sigma-rule
• Potentially Suspicious Wuauclt Network Connection · sigma-rule
• PowerShell MSI Install via WindowsInstaller COM From Remote Location · sigma-rule
• Process Memory Dump Via Dotnet-Dump · sigma-rule
• Process Proxy Execution Via Squirrel.EXE · sigma-rule
• Program Executed Using Proxy/Local Command Via SSH.EXE · sigma-rule
• Proxy Execution Via Wuauclt.EXE · sigma-rule
• REGISTER_APP.VBS Proxy Execution · sigma-rule
• Remote File Download Via Findstr.EXE · sigma-rule
• RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses · sigma-rule
• Renamed MegaSync Execution · sigma-rule
• Renamed ZOHO Dctask64 Execution · sigma-rule
• Scheduled Task Creation with Curl and PowerShell Execution Combo · sigma-rule
• Sdiagnhost Calling Suspicious Child Process · sigma-rule
• Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location · sigma-rule
• Self Extraction Directive File Created In Potentially Suspicious Location · sigma-rule
• Sensitive File Dump Via Print.EXE · sigma-rule
• Suspicious AddinUtil.EXE CommandLine Execution · sigma-rule
• Suspicious AgentExecutor PowerShell Execution · sigma-rule
• Suspicious BitLocker Access Agent Update Utility Execution · sigma-rule
• Suspicious Child Process Of BgInfo.EXE · sigma-rule
• Suspicious Csi.exe Usage · sigma-rule
• Suspicious DLL Loaded via CertOC.EXE · sigma-rule
• Suspicious DotNET CLR Usage Log Artifact · sigma-rule
• Suspicious HH.EXE Execution · sigma-rule
• Suspicious MSDT Parent Process · sigma-rule
• Suspicious Provlaunch.EXE Child Process · sigma-rule
• Suspicious Speech Runtime Binary Child Process · sigma-rule
• Suspicious Vsls-Agent Command With AgentExtensionPath Load · sigma-rule
• Suspicious ZipExec Execution · sigma-rule
• SyncAppvPublishingServer Bypass Powershell Restriction - PS Module · sigma-rule
• SyncAppvPublishingServer Execute Arbitrary PowerShell Code · sigma-rule
• SyncAppvPublishingServer Execution to Bypass Powershell Restriction · sigma-rule
• SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code · sigma-rule
• Time Travel Debugging Utility Usage · sigma-rule
• Time Travel Debugging Utility Usage - Image · sigma-rule
• Uncommon Assistive Technology Applications Execution Via AtBroker.EXE · sigma-rule
• Uncommon AddinUtil.EXE CommandLine Execution · sigma-rule
• Uncommon Child Process Of AddinUtil.EXE · sigma-rule
• Uncommon Child Process Of Appvlp.EXE · sigma-rule
• Uncommon Child Process Of BgInfo.EXE · sigma-rule
• Uncommon Child Process Of Defaultpack.EXE · sigma-rule
• Uncommon Child Process Of Setres.EXE · sigma-rule
• Uncommon Link.EXE Parent Process · sigma-rule
• Use of Scriptrunner.exe · sigma-rule
• Use Of The SFTP.EXE Binary As A LOLBIN · sigma-rule
• Use of VisualUiaVerifyNative.exe · sigma-rule
• Verclsid.exe Runs COM Object · sigma-rule
• Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution · sigma-rule
• Visual Studio NodejsTools PressAnyKey Renamed Execution · sigma-rule
• Windows MSIX Package Support Framework AI_STUBS Execution · sigma-rule
• Windows Shell/Scripting Processes Spawning Suspicious Programs · sigma-rule
• Winrs Local Command Execution · sigma-rule
• Wlrmdr.EXE Uncommon Argument Or Child Process · sigma-rule
• WSL Child Process Anomaly · sigma-rule
• XBAP Execution From Uncommon Locations Via PresentationHost.EXE · sigma-rule