Rule Library
Sigma Rules
2 rules found for "Relativity"
3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhightest
Metasploit Or Impacket Service Installation Via SMB PsExec
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation
Windowssecurity
TA0008 · Lateral MovementT1021.002 · SMB/Windows Admin SharesT1570 · Lateral Tool TransferTA0002 · Execution+1
Bartlomiej Czyz+1Thu Jan 21windows
Detectionhightest
Rundll32 Execution Without Parameters
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
WindowsProcess Creation
TA0008 · Lateral MovementT1021.002 · SMB/Windows Admin SharesT1570 · Lateral Tool TransferTA0002 · Execution+1
Bartlomiej Czyz+1Sun Jan 31windows