Rule Library
Sigma Rules
4 rules found for "Tuan Le (NCSGroup)"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionmediumtest
Group Has Been Deleted Via Groupdel
Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks
LinuxProcess Creation
Tuan Le (NCSGroup)Mon Dec 26linux
Detectionlowtest
Linux Package Uninstall
Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".
LinuxProcess Creation
Tuan Le (NCSGroup)+1Thu Mar 09linux
Detectionmediumtest
User Has Been Deleted Via Userdel
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
LinuxProcess Creation
Tuan Le (NCSGroup)Mon Dec 26linux
Detectionmediumtest
Potential Suspicious PowerShell Keywords
Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework
WindowsPowerShell Script
Florian Roth (Nextron Systems)+2Mon Feb 11windows