Rule Library
Sigma Rules
3 rules found for "@sbousseaden"
3,707Total
3,116Detection
451Emerging
137Hunting
Emerging Threathightest
Operation Wocao Activity
Detects activity mentioned in Operation Wocao report
WindowsProcess Creation
TA0004 · Privilege EscalationTA0003 · PersistenceTA0007 · DiscoveryT1012 · Query Registry+7
Florian Roth (Nextron Systems)+1Fri Dec 202019
Emerging Threathightest
Operation Wocao Activity - Security
Detects activity mentioned in Operation Wocao report
Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceTA0007 · DiscoveryT1012 · Query Registry+7
Florian Roth (Nextron Systems)+1Fri Dec 202019
Emerging Threathightest
Potential Exploitation Attempt From Office Application
Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)
WindowsProcess Creation
TA0002 · ExecutionTA0005 · Defense Evasioncve.2021-40444detection.emerging-threats
Christian Burkard (Nextron Systems)+1Thu Jun 022021