Rule Library
Sigma Rules
5 rules found for "Nik Seetharaman"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhighstable
CMSTP Execution Process Access
Detects various indicators of Microsoft Connection Manager Profile Installer execution
WindowsProcess Access
Nik SeetharamanMon Jul 16windows
Detectionhighstable
CMSTP Execution Process Creation
Detects various indicators of Microsoft Connection Manager Profile Installer execution
WindowsProcess Creation
Nik SeetharamanMon Jul 16windows
Detectionhighstable
CMSTP UAC Bypass via COM Object Access
Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)
WindowsProcess Creation
Nik Seetharaman+1Wed Jul 31windows
Detectionhighstable
CMSTP Execution Registry Event
Detects various indicators of Microsoft Connection Manager Profile Installer execution
WindowsRegistry Event
Nik SeetharamanMon Jul 16windows
Threat Huntmediumtest
Microsoft Workflow Compiler Execution
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
WindowsProcess Creation
Nik Seetharaman+1Wed Jan 16windows