Siemphony
@siemphony
Reference detections derived from the MITRE ATT&CK detection layer. Machine-authored and unverified — a starting point to fork and test, not a deployable ruleset.
Repertoire
- published compositions
- 400
- ATT&CK techniques covered
- 402
- tactics represented
- 13
All compositions
169–192 of 400 compositions
- T1547.006
Kernel module loaded or the module tree modified on Linux
3 of 4 backends · unverified000 - T1056.001
Keyboard class filter driver registered under the class key
4 of 4 backends · unverified000 - T1542.001
Known BIOS/UEFI firmware flash utility launched
4 of 4 backends · unverified000 - T1685.004
Linux Audit system disabled, purged or its config files tampered with
3 of 4 backends · unverified000 - T1566.002
Linux browser process spawning a shell or script interpreter
4 of 4 backends · unverified000 - T1542.002
Linux firmware flashing tool executed
3 of 4 backends · unverified000 - T1557
Linux host rewrites /etc/hosts or /etc/resolv.conf
3 of 4 backends · unverified000 - T1222.002
Linux syscall changes a file's permissions, owner, or xattrs
3 of 4 backends · unverified000 - T1190
Linux web server spawning a shell or network download utility
4 of 4 backends · unverified000 - T1087.001
Local account and group enumeration from a command line
4 of 4 backends · unverified000 - T1136.001
Local account created from a command line
0% noise measured in lab
4 of 4 backends · verified000 - T1003.002
Local credential registry hive saved or exported to disk
0% noise measured in lab
4 of 4 backends · verified000 - T1680
Local drive and volume enumeration from the command line
4 of 4 backends · unverified000 - T1069.001
Local group enumeration via net localgroup or Get-LocalGroup
0% noise measured in lab
4 of 4 backends · verified000 - T1114.001
Local mail store referenced by a shell or archiving utility
4 of 4 backends · unverified000 - T1201
Local or domain password policy queried from the command line
4 of 4 backends · unverified000 - T1033
Logged-on user identity queried by a built-in enumeration tool
0% noise measured in lab
4 of 4 backends · verified000 - T1056.003
Login page file written under a portal web root
4 of 4 backends · unverified000 - T1078.001
Logon by the built-in Administrator or Guest account
4 of 4 backends · unverified000 - T1037.001
Logon initialisation spawns a process other than the shell
4 of 4 backends · unverified000 - T1037.003
Logon script written to the NETLOGON or SYSVOL share
4 of 4 backends · unverified000 - T1134.004
LOLBAS process reports a sensitive system process as its parent
4 of 4 backends · unverified000 - T1071.004
Long encoded DNS label queried by a script host or proxy binary
2 of 4 backends · unverified000 - T1564.005
Loop device created or file loop-mounted as a filesystem
3 of 4 backends · unverified000