Challenges

Write a Sigma rule against attack logs and normal logs from the same machines. The result shows which attack events were caught, which were missed and which normal events matched.

New to Sigma? Start with the lessons.

1. mshta running script codeprocess_creation · T1218.005 · 2,230 events, 3 to find
2. Encoded PowerShell commandsprocess_creation · T1059.001, T1027 · 2,351 events, 13 to find
3. Persistence through a Run keyregistry_set · T1547.001 · 9,693 events, 2 to find
4. Access to LSASS memoryprocess_access · T1003.001 · 4,359 events, 8 to find
5. Scheduled tasks that run a commandprocess_creation · T1053.005 · 2,442 events, 3 to find
6. Remote execution through services and WMIprocess_creation · T1569.002, T1047 · 2,245 events, 5 to find
7. Copying the password hives and the AD databaseprocess_creation · T1003.002, T1003.003, T1003.004 · 2,262 events, 6 to find
8. Turning off event logging through the registryregistry_set · T1562.002, T1562.003 · 11,088 events, 6 to find
9. Turning off logging from the command lineprocess_creation · T1562.002, T1562.006 · 2,311 events, 10 to find
10. Network connections from processes that should not have anynetwork_connection · T1055, T1574.001, T1218.004, T1071.001 · 2,146 events, 20 to find