Phoenix
Sigma IntelligenceBeta
All Authors
SW

Sander Wiebing

@sWiebing
First rule: Sat Aug 25 2018 02:00:00 GMT+0200 (Central European Summer Time)
Commits on SigmaHQPull Requests
Share profile card
0rules authored
1sole author
12co-authored
Top Log Sources
1
windows / process_creation
10 rules
2
windows / create_stream_hash
1 rules
3
windows / file_event
1 rules
Rule Types
detection
13
By Severity
critical
0
high
7
medium
4
low
2
informational
0
By Status
stable
0
test
12
experimental
1
deprecated
0
unsupported
0
0
Total Rules
0
Stable Rules
0
High / Critical
0
Log Source Types
Recent RulesAll rules →
Files With System Process Name In Unsuspected Locations
Tue May 26 2020 02:00:00 GMT+0200 (Central European Summer Time)
mediumDetection
New RUN Key Pointing to Suspicious Folder
Sat Aug 25 2018 02:00:00 GMT+0200 (Central European Summer Time)
highDetection
Exports Critical Registry Keys To a File
Mon Oct 12 2020 02:00:00 GMT+0200 (Central European Summer Time)
highDetection
Exports Registry Key To a File
Wed Oct 07 2020 02:00:00 GMT+0200 (Central European Summer Time)
lowDetection
Imports Registry Key From a File
Wed Oct 07 2020 02:00:00 GMT+0200 (Central European Summer Time)
mediumDetection
Imports Registry Key From an ADS
Mon Oct 12 2020 02:00:00 GMT+0200 (Central European Summer Time)
highDetection
Browse all 13 rules by Sander Wiebing
Filter the full rule library to see only their contributions
View Rules →