Rule Library
Sigma Rules
2 rules found for "CrimpSec"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
HackTool - SharpMove Tool Execution
Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.
WindowsProcess Creation
Luca Di Bartolomeo (CrimpSec)Mon Jan 29windows
Detectionmediumtest
Disable Internal Tools or Feature in Registry
Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)
WindowsRegistry Set
François Hubaut+2Fri Mar 18windows