Phoenix
Sigma IntelligenceBeta
All Authors
SL

Stephen Lincoln

AttackIQ
First rule: Thu Dec 21 2023 00:00:00 GMT+0000 (Coordinated Universal Time)
Share profile card
0rules authored
3sole author
1co-authored
Top Log Sources
1
windows / process_creation
2 rules
2
macos / process_creation
1 rules
3
windows / registry_set
1 rules
Rule Types
detection
4
By Severity
critical
0
high
0
medium
4
low
0
informational
0
By Status
stable
0
test
4
experimental
0
deprecated
0
unsupported
0
0
Total Rules
0
Stable Rules
0
High / Critical
0
Log Source Types
Recent RulesAll rules →
System Disk And Volume Reconnaissance Via Wmic.EXE
Fri Feb 02 2024 00:00:00 GMT+0000 (Coordinated Universal Time)
mediumDetection
Potentially Suspicious Desktop Background Change Via Registry
Thu Dec 21 2023 00:00:00 GMT+0000 (Coordinated Universal Time)
mediumDetection
System Information Discovery Using System_Profiler
Tue Jan 02 2024 00:00:00 GMT+0000 (Coordinated Universal Time)
mediumDetection
Potentially Suspicious Desktop Background Change Using Reg.EXE
Thu Dec 21 2023 00:00:00 GMT+0000 (Coordinated Universal Time)
mediumDetection
Browse all 4 rules by Stephen Lincoln
Filter the full rule library to see only their contributions
View Rules →