Rule Library

Sigma Rules

20 rules found for "Sittikorn S"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionmediumstable

AWS EC2 Disable EBS Encryption

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

AWScloudtrail
TA0040 · ImpactT1486 · Data Encrypted for ImpactT1565 · Data Manipulation
Sittikorn STue Jun 29cloud
Detectionhighstable

AWS SecurityHub Findings Evasion

Detects the modification of the findings on SecurityHub.

AWScloudtrail
TA0005 · Defense EvasionT1562 · Impair Defenses
Sittikorn SMon Jun 28cloud
Detectionmediumstable

Linux Doas Conf File Creation

Detects the creation of doas.conf file in linux host platform.

LinuxFile Event
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548 · Abuse Elevation Control Mechanism
Sittikorn S+1Thu Jan 20linux
Detectionlowstable

Linux Doas Tool Execution

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

LinuxProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548 · Abuse Elevation Control Mechanism
Sittikorn S+1Thu Jan 20linux
Detectionhightest

KrbRelayUp Service Installation

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Windowssystem
TA0003 · PersistenceTA0004 · Privilege EscalationT1543 · Create or Modify System Process
Sittikorn S+1Wed May 11windows
Detectionhightest

HackTool - Certipy Execution

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

WindowsProcess Creation
TA0007 · DiscoveryTA0006 · Credential AccessT1649 · Steal or Forge Authentication Certificates
Martin Mueller+1Mon Apr 17windows
Detectionhightest

PUA - Rclone Execution

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

WindowsProcess Creation
TA0010 · ExfiltrationT1567.002 · Exfiltration to Cloud Storage
Bhabesh Raj+2Mon May 10windows
Detectionhightest

Renamed MegaSync Execution

Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.

WindowsProcess Creation
TA0005 · Defense EvasionT1218 · System Binary Proxy Execution
Sittikorn STue Jun 22windows
Detectionhightest

Script Event Consumer Spawning Process

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

WindowsProcess Creation
TA0002 · ExecutionT1047 · Windows Management Instrumentation
Sittikorn SMon Jun 21windows
Detectionmediumtest

Potential Process Hollowing Activity

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Windowsprocess_tampering
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1055.012 · Process Hollowing
Christopher Peacock+2Tue Jan 25windows
Detectionmediumtest

Removal Of SD Value to Hide Schedule Task - Registry

Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware

WindowsRegistry Delete
TA0005 · Defense EvasionT1562 · Impair Defenses
Sittikorn SFri Apr 15windows
Emerging Threatcriticalstable

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Antivirus Alert
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1055 · Process Injectiondetection.emerging-threats+2
Sittikorn S+2Thu Jul 012021
Emerging Threathightest

VMware vCenter Server File Upload CVE-2021-22005

Detects exploitation attempts using file upload vulnerability CVE-2021-22005 in the VMWare vCenter Server.

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2021-22005detection.emerging-threats
Sittikorn SFri Sep 242021
Emerging Threathighstable

Pulse Connect Secure RCE Attack CVE-2021-22893

This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2021-22893detection.emerging-threats
Sittikorn STue Jun 292021
Emerging Threathightest

Potential CVE-2021-26084 Exploitation Attempt

Detects potential exploitation of CVE-2021-260841 a Confluence RCE using OGNL injection

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2021-26084detection.emerging-threats
Sittikorn S+1Tue Dec 132021
Emerging Threatcriticaltest

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

WindowsFile Event
TA0001 · Initial AccessTA0002 · ExecutionTA0006 · Credential AccessT1566 · Phishing+4
Sittikorn SFri Jul 162021
Emerging Threatcriticaltest

CVE-2021-31979 CVE-2021-33771 Exploits

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

WindowsRegistry Set
TA0001 · Initial AccessTA0002 · ExecutionTA0006 · Credential AccessT1566 · Phishing+4
Sittikorn S+1Fri Jul 162021
Emerging Threathightest

Suspicious Word Cab File Write CVE-2021-40444

Detects file creation patterns noticeable during the exploitation of CVE-2021-40444

WindowsFile Event
TA0042 · Resource DevelopmentT1587 · Develop Capabilitiesdetection.emerging-threats
Florian Roth (Nextron Systems)+1Fri Sep 102021
Emerging Threatcriticaltest

CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0003 · PersistenceT1505.003 · Web Shell+2
Sittikorn S+1Fri Sep 102021
Emerging Threatmediumtest

Suspicious Set Value of MSDT in Registry (CVE-2022-30190)

Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

WindowsRegistry Set
TA0005 · Defense Evasionattack.t1221detection.emerging-threats
Sittikorn SSun May 312022