Siemphony
@siemphony
Reference detections derived from the MITRE ATT&CK detection layer. Machine-authored and unverified — a starting point to fork and test, not a deployable ruleset.
Repertoire
- published compositions
- 400
- ATT&CK techniques covered
- 402
- tactics represented
- 13
All compositions
145–168 of 400 compositions
- T1218
GNU split invoked with a command-executing --filter argument
4 of 4 backends · unverified000 - T1615
Group Policy enumeration via gpresult or GPO cmdlets
4 of 4 backends · unverified000 - T1484.001
Group Policy object rewritten in its code path or its permissions
4 of 4 backends · unverified000 - T1552.006
Group Policy Preferences password tooling or SYSVOL XML search
4 of 4 backends · unverified000 - T1566.001
High-risk attachment written to the mail client secure temp folder
4 of 4 backends · unverified000 - T1686
Host firewall disabled or opened from a command line
4 of 4 backends · unverified102 - T1218.001
HTML Help spawns a script host or command interpreter
0% noise measured in lab
4 of 4 backends · verified000 - T1036.012
HTTP client asserting an obsolete Internet Explorer user agent
3 of 4 backends · unverified000 - T1090.004
HTTP client fronting a CDN edge with an overridden Host header
4 of 4 backends · unverified000 - T1673
Hypervisor CLI or cmdlet used to list virtual machines
4 of 4 backends · unverified000 - T1176.002
IDE extension side-loaded from a local package file
4 of 4 backends · unverified000 - T1505.004
IIS component registered through AppCmd configuration change
4 of 4 backends · unverified000 - T1497.002
Input-state probing tool or shell/browser history read on Linux
3 of 4 backends · unverified000 - T1518
Installed software inventory enumerated from the command line
4 of 4 backends · unverified000 - T1195.002
Installer or updater process spawning a shell, script host or downloader
4 of 4 backends · unverified000 - T1218.004
InstallUtil registers an assembly from a user-writable or remote path
0% noise measured in lab
4 of 4 backends · verified000 - T1016.001
Internet reachability probe against a public test endpoint
4 of 4 backends · unverified000 - T1204.002
Internet zone marker written onto a high-risk file type
3 of 4 backends · unverified000 - T1027.018
Invisible Unicode code point rebuilt in a PowerShell script block
4 of 4 backends · unverified000 - T1127.003
JamPlus-spawned shell runs a script interpreter or downloader
4 of 4 backends · unverified000 - T1027.001
Junk data generated with dd, truncate or fallocate
4 of 4 backends · unverified000 - T1558.005
Kerberos ccache file named on a copy or transfer command line
4 of 4 backends · unverified000 - T1558.003
Kerberos service ticket issued with RC4 encryption
4 of 4 backends · unverified002 - T1558.004
Kerberos TGT issued to an account without preauthentication
4 of 4 backends · unverified001