A Sigma rule for registry Run-key persistence catches the most-taught autostart technique on Windows: an attacker writing a value under ...
MITRE ATT&CK to SIEM Rules: A Practical Look at SIOR-Helper
Sigma Rule for Cleared Event Logs: Event 1102
0 Comments
10 min read
A Sigma rule for cleared event logs catches one of the noisiest things an attacker can do on the way out: wiping the Windows event log t...
Sigma Rule for Suspicious Service Installs: 7045
0 Comments
10 min read
A Sigma rule for Windows service installation catches a persistence and privilege-escalation pattern that has not gone out of style: an ...
