Rule Library
Sigma Rules
3 rules found for "Jose Rodriguez"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
Exchange Set OabVirtualDirectory ExternalUrl Property
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log
Windowsmsexchange-management
Jose RodriguezMon Mar 15windows
Detectionhightest
SMB Create Remote File Admin Share
Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
Windowssecurity
Jose Rodriguez+1Thu Aug 06windows
Detectionmediumtest
Enabling COR Profiler Environment Variables
Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
WindowsRegistry Set
Jose Rodriguez+2Thu Sep 10windows