Rule Library
Sigma Rules
4 rules found for "Maxime Thiebaut"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionmediumtest
Potential AD User Enumeration From Non-Machine Account
Detects read access to a domain user from a non-machine account
Windowssecurity
Maxime ThiebautMon Mar 30windows
Detectionmediumtest
Desktop.INI Created by Uncommon Process
Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
WindowsFile Event
Maxime Thiebaut+1Thu Mar 19windows
Detectionhightest
Execution via WorkFolders.exe
Detects using WorkFolders.exe to execute an arbitrary control.exe
WindowsProcess Creation
Maxime ThiebautThu Oct 21windows
Emerging Threathightest
Suspicious RazerInstaller Explorer Subprocess
Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM
WindowsProcess Creation
Florian Roth (Nextron Systems)+1Mon Aug 232021