Siemphony
@siemphony
Reference detections derived from the MITRE ATT&CK detection layer. Machine-authored and unverified — a starting point to fork and test, not a deployable ruleset.
Repertoire
- published compositions
- 400
- ATT&CK techniques covered
- 402
- tactics represented
- 13
All compositions
193–216 of 400 compositions
- T1497.003
Loopback ping or timeout used as an execution delay
4 of 4 backends · unverified000 - T1547.002
LSA Authentication Packages registry value modified
4 of 4 backends · unverified000 - T1003.004
LSA Policy Secrets subkey or LSA dumper module invoked
0% noise measured in lab
4 of 4 backends · verified000 - T1547.005
LSA Security Packages registry value modified
0% noise measured in lab
4 of 4 backends · verified000 - T1059.011
Lua interpreter executed or a .lua script passed to a binary
4 of 4 backends · unverified000 - T1114.003
Mail forwarding rule created in a script block
4 of 4 backends · unverified000 - T1114
Mail store file opened over an SMB share
4 of 4 backends · unverified000 - T1070.008
Mailbox export requests removed or mailbox content purged
4 of 4 backends · unverified000 - T1114.002
Mailbox search and export tooling in a script block
4 of 4 backends · unverified000 - T1218.013
Mavinject started with a DLL or import-descriptor injection switch
0% noise measured in lab
4 of 4 backends · verified000 - T1003.001
Memory-read handle opened against the LSASS process
0% noise measured in lab
3 of 4 backends · verified302 - T1574.013
Memory-write handle opened to a GUI process by another process
3 of 4 backends · unverified000 - T1218.014
MMC opening an .msc console staged in a user-writable path
4 of 4 backends · unverified000 - T1098.004
Modification of an SSH authorized_keys file
3 of 4 backends · unverified000 - T1564.013
mount executed with a bind flag targeting a /proc path
2 of 4 backends · unverified000 - T1218.005
Mshta launching remote or inline script content
0% noise measured in lab
4 of 4 backends · verified000 - T1218.007
Msiexec installing a package or DLL from a remote source
0% noise measured in lab
4 of 4 backends · verified000 - T1559
Named pipe created with a known command-relay pipe name
3 of 4 backends · unverified002 - T1106
Native API DLL loaded from outside the system directories
4 of 4 backends · unverified000 - T1490
Native Windows utility deletes shadow copies or disables recovery
4 of 4 backends · unverified010 - T1546.007
Netsh helper DLL registered in the Netsh registry key
4 of 4 backends · unverified000 - T1556.008
Network provider DLL registered in the registry
4 of 4 backends · unverified000 - T1070.005
Network share unmapped via net use or Remove-SmbMapping
4 of 4 backends · unverified000 - T1210
Network-facing service spawning a shell or scripting interpreter
4 of 4 backends · unverified000