1200KM / tag
attack.t1564.004 — sigma-tag tag
22 related reference pages for sigma-tag: attack.t1564.004.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Execute From Alternate Data Streams · sigma-rule
- Exports Registry Key To an Alternate Data Stream · sigma-rule
- HackTool Named File Stream Created · sigma-rule
- Hidden Executable In NTFS Alternate Data Stream · sigma-rule
- Hidden Flag Set On File/Directory Via Chflags - MacOS · sigma-rule
- Insensitive Subfolder Search Via Findstr.EXE · sigma-rule
- NTFS Alternate Data Stream · sigma-rule
- Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream · sigma-rule
- Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI · sigma-rule
- Potential Rundll32 Execution With DLL Stored In ADS · sigma-rule
- Powershell Store File In Alternate Data Stream · sigma-rule
- PrintBrm ZIP Creation of Extraction · sigma-rule
- Remote File Download Via Findstr.EXE · sigma-rule
- Run PowerShell Script from ADS · sigma-rule
- Suspicious Diantz Alternate Data Stream Execution · sigma-rule
- Suspicious Extrac32 Alternate Data Stream Execution · sigma-rule
- Suspicious File Download From File Sharing Websites - File Stream · sigma-rule
- Unusual File Download from Direct IP Address · sigma-rule
- Unusual File Download From File Sharing Websites - File Stream · sigma-rule
- Use NTFS Short Name in Command Line · sigma-rule
- Use NTFS Short Name in Image · sigma-rule
- Use Short Name Path in Image · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.