1200KM / tag
attack.t1548 — sigma-tag tag
22 related reference pages for sigma-tag: attack.t1548.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Abused Debug Privilege by Arbitrary Parent Processes · sigma-rule
- AWS STS AssumeRole Misuse · sigma-rule
- AWS STS GetSessionToken Misuse · sigma-rule
- AWS Suspicious SAML Activity · sigma-rule
- CA Policy Removed by Non Approved Actor · sigma-rule
- CA Policy Updated by Non Approved Actor · sigma-rule
- COM Hijack via Sdclt · sigma-rule
- Credential Dumping Attempt Via Svchost · sigma-rule
- GCP Break-glass Container Workload Deployed · sigma-rule
- Linux Capabilities Discovery · sigma-rule
- Linux Doas Conf File Creation · sigma-rule
- Linux Doas Tool Execution · sigma-rule
- Linux Setgid Capability Set on a Binary via Setcap Utility · sigma-rule
- Linux Setuid Capability Set on a Binary via Setcap Utility · sigma-rule
- New CA Policy by Non-approved Actor · sigma-rule
- Potential Privilege Escalation via Local Kerberos Relay over LDAP · sigma-rule
- Regedit as Trusted Installer · sigma-rule
- SCM Database Privileged Operation · sigma-rule
- UAC Bypass via Windows Firewall Snap-In Hijack · sigma-rule
- User Added To Group With CA Policy Modification Access · sigma-rule
- User Removed From Group With CA Policy Modification Access · sigma-rule
- Vulnerable Netlogon Secure Channel Connection Allowed · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.