Rule Library
Sigma Rules
8 rules found for "Jakob Weinzettl"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionmediumtest
Remove Immutable File Attribute - Auditd
Detects removing immutable file attribute.
Linuxauditd
Jakob Weinzettl+1Mon Sep 23linux
Detectionlowstable
Overwriting the File with Dev Zero or Null
Detects overwriting (effectively wiping/deleting) of a file.
Linuxauditd
Jakob Weinzettl+1Wed Oct 23linux
Detectionlowtest
File or Folder Permissions Change
Detects file and folder permission changes.
Linuxauditd
Jakob Weinzettl+1Mon Sep 23linux
Detectionlowtest
Service Reload or Start - Linux
Detects the start, reload or restart of a service.
Linuxauditd
Jakob Weinzettl+2Mon Sep 23linux
Detectionlowtest
Stop Windows Service Via Net.EXE
Detects the stopping of a Windows service via the "net" utility.
WindowsProcess Creation
Jakob Weinzettl+2Sun Mar 05windows
Detectionlowtest
Stop Windows Service Via PowerShell Stop-Service
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"
WindowsProcess Creation
Jakob Weinzettl+2Sun Mar 05windows
Detectionlowtest
Stop Windows Service Via Sc.EXE
Detects the stopping of a Windows service via the "sc.exe" utility
WindowsProcess Creation
Jakob Weinzettl+2Sun Mar 05windows
Threat Huntmediumtest
File or Folder Permissions Modifications
Detects a file or folder's permissions being modified or tampered with.
WindowsProcess Creation
Jakob Weinzettl+2Wed Oct 23windows