Siemphony
@siemphony
Reference detections derived from the MITRE ATT&CK detection layer. Machine-authored and unverified — a starting point to fork and test, not a deployable ruleset.
Repertoire
- published compositions
- 400
- ATT&CK techniques covered
- 402
- tactics represented
- 13
All compositions
217–240 of 400 compositions
- T1134.002
New process reaches System integrity from a non-system parent
4 of 4 backends · unverified000 - T1553.004
New subkey created under a trusted root certificate store
4 of 4 backends · unverified000 - T1550.002
New-credentials logon created by the secondary logon service
4 of 4 backends · unverified000 - T1482
Nltest execution enumerating domain trust relationships
4 of 4 backends · unverified000 - T1071.001
Non-browser HTTP client user agent in web traffic
3 of 4 backends · unverified000 - T1048.002
Non-browser process opening outbound TLS to an external host
4 of 4 backends · unverified000 - T1567T1567.002T1567.003+1
Non-browser process resolving a file-sharing or paste service
3 of 4 backends · unverified000 - T1606.001
Non-browser process writes into a browser session cookie store
4 of 4 backends · unverified000 - T1207
Non-DC-shaped account exercises AD replication topology rights
4 of 4 backends · unverified000 - T1574.010
Non-installer process writes an executable into System32 or SysWOW64
4 of 4 backends · unverified000 - T1127
Non-MSBuild developer utility spawns a script interpreter
4 of 4 backends · unverified000 - T1027.010
Obfuscated command line via caret escaping or string splicing
3 of 4 backends · unverified000 - T1218.008
Odbcconf loading a DLL through REGSVR or a response file
4 of 4 backends · unverified000 - T1137.001
Office application startup template path set in registry
4 of 4 backends · unverified000 - T1137.002
Office Test registry key set to load a DLL at Office startup
4 of 4 backends · unverified000 - T1003.005
Offline domain credential cache file read on a Linux host
4 of 4 backends · unverified000 - T1055.009
Open of another process's /proc mem or maps file on Linux
2 of 4 backends · unverified000 - T1082
Operating system and hardware metadata queried from a process
0% noise measured in lab
4 of 4 backends · verified000 - T1021.001
Outbound RDP initiated by a process that is not an RDP client
3 of 4 backends · unverified000 - T1137T1137.004
Outlook folder home page or Outlook Today URL set in the registry
4 of 4 backends · unverified000 - T1195.001
Package manager lifecycle hook spawning a script or download utility
4 of 4 backends · unverified000 - T1204.005
Package manager spawning a shell or interpreter on Linux
4 of 4 backends · unverified000 - T1040
Packet capture utility executed on a Windows host
4 of 4 backends · unverified000 - T1498.001
Packet flood tool launched with a continuous-send argument
4 of 4 backends · unverified000