zshanhyder01-Detection-Engineering

dcom_activation_svchost_t1021.003

Update sigma.yml

2026-05-02 13:33:31 +05:00

detect_admin_share_access_t1021.002

Create elastic.eql

2026-04-29 15:49:45 +05:00

detect_autostart_lsa_package_t1547

Create sigma.yml

2026-07-20 13:32:22 +05:00

detect_autostart_print_spooler_dll_t1547

Create sigma.yml

2026-07-20 13:35:32 +05:00

detect_autostart_run_key_t1547

Rename sigma.yml to sigma.yml

2026-07-20 13:26:03 +05:00

detect_autostart_startup_folder_t1547

Create sigma.yml

2026-07-20 13:27:41 +05:00

detect_autostart_winlogon_helper_t1547

Create sigma.yml

2026-07-20 13:29:20 +05:00

detect_clickfix_download_and_execute

Create sigma.yml

2026-07-23 16:08:40 +05:00

detect_clickfix_execution_from_user_folder

Create sigma.yml

2026-07-23 16:15:32 +05:00

detect_clickfix_explorer_spawns_interpreter

Create sigma.yml

2026-07-23 16:12:30 +05:00

detect_clickfix_runmru_suspicious_command

Create sigma.yml

2026-07-23 16:05:52 +05:00

detect_clickfix_typedpaths_suspicious_command

Create sigma.yml

2026-07-23 16:06:54 +05:00

detect_Cloud_Storage_CLI_Upload_Utility_Execution_t1567.002

Create sigma.yml

2026-07-20 16:05:32 +05:00

detect_COM_Hijacking_Persistence_T1546.015

Create sigma.yml

2026-06-16 00:08:07 +05:00

detect_com_shell_payload_t1059

Create sigma.yml

2026-05-02 13:31:43 +05:00

Detect_Data_Staged_via_Archive_Utility_t1560.001

Create sigma.yml

2026-07-20 16:22:20 +05:00

detect_discovery_under_web_identity

Create sigma.yml

2026-07-23 12:15:48 +05:00

detect_dll_side_loading_t1574_t036

Create elastic.eql

2026-06-13 18:09:07 +05:00

detect_external_rdp_logon_success

Create sigma.yml

2026-07-24 11:55:52 +05:00

detect_Failed_Logon_to_a_Remote_Service

Create sigma.yml

2026-07-24 12:02:38 +05:00

detect_file_creation_startup_folder_t1547.001

Create elastic.eql

2026-06-13 16:56:00 +05:00

detect_file_deletion

Create elastic.eql

2026-04-12 20:30:38 +05:00

detect_file_drop

Create elastic.eql

2026-04-12 20:20:39 +05:00

detect_lsass_access_t1003.001

Create elastic.eql

2026-04-13 23:42:53 +05:00

detect_Network_Logon_via_Machine_Account_t1078.002

Create elastic.eql

2026-05-10 00:13:44 +05:00

Detect_Non_Browser_Network_Connection_to_Cloud_Storage_Service

Create sigma.yml

2026-07-20 16:14:27 +05:00

detect_pass_the_ticket_command_line_t1550.003

Create elastic.eql

2026-04-29 15:51:08 +05:00

detect_print_spooler_outbound_connection_t1210

Update sigma.yml

2026-05-10 00:15:04 +05:00

detect_process_spwan_by_services_exe

Update sigma.yml

2026-04-12 20:28:57 +05:00

Detect_Rclone_Data_Exfiltration_Tool_Execution_t1567.002

Rename sigma.yml to sigma.yml

2026-07-20 16:03:05 +05:00

detect_registry_add_modify_t1547.001

Create sigma.yml

2026-06-10 17:04:21 +05:00

detect_remote_access_enabled_config_change

Create sigma.yml

2026-07-24 12:00:44 +05:00

detect_remote_logon_t1021.003

Update sigma.yml

2026-05-02 13:25:33 +05:00

detect_remote_wmi_rpc_connection

Create elastic.eql

2026-04-14 02:02:00 +05:00

detect_sacrificial_process_ticket_injection_T1550.003

Update elastic.eql

2026-04-29 16:01:25 +05:00

detect_scheduled_task_deleted_t1053

Create sigma.yml

2026-07-19 00:21:48 +05:00

detect_scheduled_task_registered_t1053

Create sigma.yml

2026-07-19 00:19:40 +05:00

detect_schtasks_creation_cmdline_t1053

Create sigma.yml

2026-07-19 00:17:33 +05:00

Detect_Scripted_Upload_to_Cloud_Storage_Endpoint_t1567.002

Create sigma.yml

2026-07-20 16:09:58 +05:00

detect_service_creation

Update elastic.eql

2026-06-13 16:22:45 +05:00

detect_service_install_suspicious_imagepath_t1543

Delete atomic_rules/windows/detect_service_install_suspicious_imagepath_t1543/readme.md

2026-07-19 15:56:36 +05:00

Detect_Successful_RDP_Logon_t1021.001

Create elastic.eql

2026-04-13 23:43:35 +05:00

detect_suspicious_NewCredentials_Logon_t1550.003

Create elastic.eql

2026-04-29 16:02:56 +05:00

Detect_Suspicious_Process_ Initiating_Network_Connection

Create sigma.yml

2026-06-23 00:39:40 +05:00

detect_suspicious_scheduled_task_creation_t1053.005

Create sigma.yml

2026-06-10 16:36:36 +05:00

detect_tunnelling_tool_execution

Create sigma.yml

2026-07-24 11:58:49 +05:00

detect_unsanctioned_remote_access_tool

Create sigma.yml

2026-07-24 11:57:39 +05:00

detect_webserver_spawn_interpreter_win

Create sigma.yml

2026-07-23 12:02:34 +05:00

detect_webshell_write_to_webroot

Create sigma.yml

2026-07-23 12:08:22 +05:00

detect_WMI_Event_Subscription_Persistence_t1546.003

Create elastic.eql

2026-06-13 16:43:56 +05:00

detect_wmi_process_span_t1047

Create elastic.eql

2026-04-14 02:03:30 +05:00

DNS_Query_For_Tunneling_Prone_Record_Types

Create sigma.yml

2026-07-18 16:07:20 +05:00

DNS_Query_With_Anomalously_Long_Name

Create sigma.yml

2026-07-18 16:01:20 +05:00

DNS_Query_With_Long_Encoded_Subdomain_Label

Create sigma.yml

2026-07-18 16:04:07 +05:00

Known_DNS_Tunneling_Tool_Activity

Create sigma.yml

2026-07-18 16:10:21 +05:00

service_creation_cmdline_t1543

Create sigma.yml

2026-07-19 15:57:40 +05:00

service_imagepath_registry_tamper_t1543

Create sigma.yml

2026-07-19 16:02:07 +05:00

UAC_Bypass_via_Fodhelper_t1548.002

Create elastic.eql

2026-04-13 23:44:42 +05:00