Sigma Rules
12 rules found for "wagga"
Possible Impacket SecretDump Remote Activity
Detect AD credential dumping using impacket secretdump HKTL
NetNTLM Downgrade Attack
Detects NetNTLM downgrade attack
Potential DCOM InternetExplorer.Application DLL Hijack
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network
Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
HackTool - Koadic Execution
Detects command line parameters used by Koadic hack tool
Suspicious Child Process Of SQL Server
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Windows Admin Share Mount Via Net.EXE
Detects when an admin share is mounted using net.exe
Potential Powershell ReverseShell Connection
Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.
NetNTLM Downgrade Attack - Registry
Detects NetNTLM downgrade attack
Common Autorun Keys Modification
Detects modification of autostart extensibility point (ASEP) in registry.
CVE-2020-0688 Exploitation via Eventlog
Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688
Lazarus Group Activity
Detects different process execution behaviors as described in various threat reports on Lazarus group activity