Rule Library
Sigma Rules
3 rules found for "Sami Ruohonen"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
NTFS Alternate Data Stream
Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
WindowsPowerShell Script
Sami RuohonenTue Jul 24windows
Detectionmediumtest
Hiding Files with Attrib.exe
Detects usage of attrib.exe to hide files from users.
WindowsProcess Creation
Sami RuohonenWed Jan 16windows
Detectionmediumtest
Suspicious XOR Encoded PowerShell Command
Detects presence of a potentially xor encoded powershell command
WindowsProcess Creation
Sami Ruohonen+6Wed Sep 05windows