Sigma Rules
10 rules found for "wagga"
Possible Impacket SecretDump Remote Activity
Detect AD credential dumping using impacket secretdump HKTL
NetNTLM Downgrade Attack
Detects NetNTLM downgrade attack
Potential DCOM InternetExplorer.Application DLL Hijack
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network
Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
HackTool - Koadic Execution
Detects command line parameters used by Koadic hack tool
Suspicious Child Process Of SQL Server
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Windows Admin Share Mount Via Net.EXE
Detects when an admin share is mounted using net.exe
Potential Powershell ReverseShell Connection
Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.
NetNTLM Downgrade Attack - Registry
Detects NetNTLM downgrade attack
Common Autorun Keys Modification
Detects modification of autostart extensibility point (ASEP) in registry.