Rule Library

Sigma Rules

64 rules found

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhightest

Remote Schedule Task Recon via ITaskSchedulerService

Detects remote RPC calls to read information about scheduled tasks

rpc_firewallapplication
TA0007 · Discovery
Sagie Dulce+1Sat Jan 01application
Detectionhightest

Remote Printing Abuse for Lateral Movement

Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

rpc_firewallapplication
TA0008 · Lateral Movement
Sagie Dulce+1Sat Jan 01application
Detectionhightest

Remote DCOM/WMI Lateral Movement

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

rpc_firewallapplication
TA0008 · Lateral MovementTA0002 · ExecutionT1021.003 · Distributed Component Object ModelT1047 · Windows Management Instrumentation
Sagie Dulce+1Sat Jan 01application
Detectionhightest

Remote Registry Lateral Movement

Detects remote RPC calls to modify the registry and possible execute code

rpc_firewallapplication
TA0005 · Defense EvasionTA0008 · Lateral MovementT1112 · Modify RegistryTA0003 · Persistence
Sagie Dulce+1Sat Jan 01application
Detectionhightest

Remote Registry Recon

Detects remote RPC calls to collect information

rpc_firewallapplication
TA0007 · Discovery
Sagie Dulce+1Sat Jan 01application
Detectionhightest

Remote Server Service Abuse

Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS

rpc_firewallapplication
TA0008 · Lateral Movement
Sagie Dulce+1Sat Jan 01application
Detectionhightest

Remote Server Service Abuse for Lateral Movement

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

rpc_firewallapplication
TA0008 · Lateral MovementTA0002 · ExecutionT1569.002 · Service Execution
Sagie Dulce+1Sat Jan 01application
Detectionhightest

Remote Schedule Task Lateral Movement via SASec

Detects remote RPC calls to create or execute a scheduled task via SASec

rpc_firewallapplication
TA0004 · Privilege EscalationTA0008 · Lateral MovementTA0002 · ExecutionTA0003 · Persistence+2
Sagie Dulce+1Sat Jan 01application
Detectionhightest

Recon Activity via SASec

Detects remote RPC calls to read information about scheduled tasks via SASec

rpc_firewallapplication
TA0007 · Discovery
Sagie Dulce+1Sat Jan 01application
Detectionhightest

SharpHound Recon Account Discovery

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

rpc_firewallapplication
T1087 · Account DiscoveryTA0007 · Discovery
Sagie Dulce+1Sat Jan 01application
Detectionhightest

SharpHound Recon Sessions

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

rpc_firewallapplication
TA0007 · DiscoveryT1033 · System Owner/User Discovery
Sagie Dulce+1Sat Jan 01application
Detectionmediumstable

Ruby on Rails Framework Exceptions

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

ruby_on_railsapplication
TA0001 · Initial AccessT1190 · Exploit Public-Facing Application
Thomas PatzkeSun Aug 06application
Detectionmediumstable

Spring Framework Exceptions

Detects suspicious Spring framework exceptions that could indicate exploitation attempts

springapplication
TA0001 · Initial AccessT1190 · Exploit Public-Facing Application
Thomas PatzkeSun Aug 06application
Detectionhightest

Potential SpEL Injection In Spring Framework

Detects potential SpEL Injection exploitation, which may lead to RCE.

springapplication
TA0001 · Initial AccessT1190 · Exploit Public-Facing Application
Moti HarmatsSat Feb 11application
Detectionhightest

Suspicious SQL Error Messages

Detects SQL error messages that indicate probing for an injection attack

sqlapplication
TA0001 · Initial AccessT1190 · Exploit Public-Facing Application
Bjoern KimminichMon Nov 27application
Detectionhightest

Potential Server Side Template Injection In Velocity

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

velocityapplication
TA0001 · Initial AccessT1190 · Exploit Public-Facing Application
Moti HarmatsSat Feb 11application