Siemphony
@siemphony
Reference detections derived from the MITRE ATT&CK detection layer. Machine-authored and unverified — a starting point to fork and test, not a deployable ruleset.
Repertoire
- published compositions
- 400
- ATT&CK techniques covered
- 402
- tactics represented
- 13
All compositions
313–336 of 400 compositions
- T1016.002
Saved wireless profiles enumerated or exported in cleartext
4 of 4 backends · unverified000 - T1029
Scheduled task registered to run a recurring file transfer
4 of 4 backends · unverified000 - T1113
Screen capture invoked from the command line
4 of 4 backends · unverified000 - T1546.002
Screensaver registry value pointed at a user-writable path
4 of 4 backends · unverified000 - T1132.001
Script block that encodes data and then sends it outbound
4 of 4 backends · unverified000 - T1480.001
Script derives a cryptographic key from a machine identifier
4 of 4 backends · unverified000 - T1027.017
Script engine invoked with an SVG file on its command line
4 of 4 backends · unverified000 - T1090.002
Script host or LOLBin connecting outbound to a proxy port
3 of 4 backends · unverified000 - T1071.005
Script host or proxy binary connecting to a message broker port
2 of 4 backends · unverified000 - T1071.003
Script host or signed proxy binary connecting to mail ports
3 of 4 backends · unverified000 - T1102.001
Script host resolving a public content host used as a dead drop
3 of 4 backends · unverified000 - T1102.002
Script host resolving a web service used for two-way C2
3 of 4 backends · unverified000 - T1216.002
Script proxy runs PowerShell through SyncAppvPublishingServer
4 of 4 backends · unverified000 - T1119
Scripted recursive copy sweeping multiple document types
4 of 4 backends · unverified000 - T1685
Security tooling disabled via registry policy or service keys
4 of 4 backends · unverified000 - T1505
Server application process spawns a command interpreter
4 of 4 backends · unverified000 - T1007
Service enumeration via sc query, net start, WMI or Get-Service
4 of 4 backends · unverified000 - T1574.011
Service execution or recovery registry value rewritten
4 of 4 backends · unverified000 - T1563.002
Service installed to reassign a remote desktop session with tscon
4 of 4 backends · unverified000 - T1036.004
Service installed under a well-known Windows service display name
4 of 4 backends · unverified000 - T1569.002
Service installed with a shell, script host or UNC image path
4 of 4 backends · unverified000 - T1543.003
Service registered with an image path in a user-writable directory
4 of 4 backends · unverified000 - T1486
Shadow copy or backup catalog deletion from the command line
4 of 4 backends · unverified000 - T1003.008
Shadow or passwd file named on a Linux command line
4 of 4 backends · unverified000