Rule Library

Sigma Rules

10 rules found for "Arnim Rupp"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectioncriticalstable

Antivirus Exploitation Framework Detection

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Alert
TA0002 · ExecutionT1203 · Exploitation for Client ExecutionTA0011 · Command and Controlattack.t1219.002
Florian Roth (Nextron Systems)+1Sun Sep 09category
Detectionhighstable

Antivirus Hacktool Detection

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Alert
TA0002 · ExecutionT1204 · User Execution
Florian Roth (Nextron Systems)+1Mon Aug 16category
Detectioncriticalstable

Antivirus Password Dumper Detection

Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Alert
TA0006 · Credential AccessT1003 · OS Credential DumpingT1558 · Steal or Forge Kerberos TicketsT1003.001 · LSASS Memory+1
Florian Roth (Nextron Systems)+1Sun Sep 09category
Detectioncriticaltest

Antivirus Ransomware Detection

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Alert
T1486 · Data Encrypted for ImpactTA0040 · Impact
Florian Roth (Nextron Systems)+1Thu May 12category
Detectionhightest

Antivirus Relevant File Paths Alerts

Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Alert
TA0042 · Resource DevelopmentT1588 · Obtain Capabilities
Florian Roth (Nextron Systems)+1Sun Sep 09category
Detectionhightest

Antivirus Web Shell Detection

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus Alert
TA0003 · PersistenceT1505.003 · Web Shell
Florian Roth (Nextron Systems)+1Sun Sep 09category
Detectionhightest

Relevant Anti-Virus Signature Keywords In Application Log

Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.

Windowsapplication
TA0042 · Resource DevelopmentT1588 · Obtain Capabilities
Florian Roth (Nextron Systems)+1Sun Feb 19windows
Detectionmediumexperimental

ADExplorer Writing Complete AD Snapshot Into .dat File

Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

WindowsFile Event
TA0007 · DiscoveryT1087.002 · Domain AccountT1069.002 · Domain GroupsT1482 · Domain Trust Discovery
Arnim Rupp (Nextron Systems)+1Wed Jul 09windows
Emerging Threatcriticaltest

Citrix Netscaler Attack CVE-2019-19781

Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2019-19781detection.emerging-threats
Arnim Rupp+1Thu Jan 022019
Emerging Threathightest

Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process

Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

LinuxProcess Creation
TA0002 · Executioncve.2024-3094detection.emerging-threats
Arnim Rupp+2Mon Apr 012024