1200KM / tag
attack.t1572 — sigma-tag tag
23 related reference pages for sigma-tag: attack.t1572.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Cloudflared Tunnel Connections Cleanup · sigma-rule
- Cloudflared Tunnel Execution · sigma-rule
- Cloudflared Tunnels Related DNS Requests · sigma-rule
- Communication To LocaltoNet Tunneling Service Initiated · sigma-rule
- Communication To LocaltoNet Tunneling Service Initiated - Linux · sigma-rule
- Communication To Ngrok Tunneling Service - Linux · sigma-rule
- Communication To Ngrok Tunneling Service Initiated · sigma-rule
- DNS Query To Devtunnels Domain · sigma-rule
- Network Connection Initiated To BTunnels Domains · sigma-rule
- Network Connection Initiated To Cloudflared Tunnels Domains · sigma-rule
- Network Connection Initiated To DevTunnels Domain · sigma-rule
- Network Connection Initiated To Visual Studio Code Tunnels Domain · sigma-rule
- Port Forwarding Activity Via SSH.EXE · sigma-rule
- Potential RDP Tunneling Via Plink · sigma-rule
- Potential RDP Tunneling Via SSH · sigma-rule
- Potentially Suspicious Usage Of Qemu · sigma-rule
- Process Initiated Network Connection To Ngrok Domain · sigma-rule
- PUA - 3Proxy Execution · sigma-rule
- PUA - Ngrok Execution · sigma-rule
- RDP Over Reverse SSH Tunnel · sigma-rule
- RDP to HTTP or HTTPS Target Ports · sigma-rule
- Silence.EDA Detection · sigma-rule
- Suspicious Plink Port Forwarding · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.