Rule Library
Sigma Rules
3 rules found for "Patrick Bareiss"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
Linux Command History Tampering
Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".
Linux
Patrick BareissSun Mar 24linux
Detectionlowtest
Local User Creation
Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
Windowssecurity
Patrick BareissThu Apr 18windows
Detectionhightest
System File Execution Location Anomaly
Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.
WindowsProcess Creation
Florian Roth (Nextron Systems)+4Mon Nov 27windows