Sigma Rules
11 rules found for "Andreas Hunkeler"
BPFtrace Unsafe Option Usage
Detects the usage of the unsafe bpftrace option
Suspicious Shells Spawn by Java Utility Keytool
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
Suspicious Processes Spawned by Java.EXE
Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)
Shell Process Spawned by Java.EXE
Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
Harvesting Of Wifi Credentials Via Netsh.EXE
Detect the harvesting of wifi credentials using netsh.exe
Potential Defense Evasion Via Binary Rename
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
Service DACL Abuse To Hide Services Via Sc.EXE
Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.
Shadow Copies Deletion Using Operating Systems Utilities
Shadow Copies deletion using operating systems utilities
Suspicious Processes Spawned by WinRM
Detects suspicious processes including shells spawnd from WinRM host process
New PortProxy Registry Entry Added
Detects the modification of the PortProxy registry key which is used for port forwarding.
New File Association Using Exefile
Detects the abuse of the exefile handler in new file association. Used for bypass of security products.