Query: write Sigma for Detects NetNTLM downgrade attack
Matching passage: Sigma rule: Detects NetNTLM downgrade attack. Logsource: windows / registry_event. Rule: title: NetNTLM Downgrade Attack - Registry id: d67572a0-e2ec-45d6-b8db-c100d14b8ef2 status: test description: Detects NetNTLM downgrade attack references: - https://web.archive.org/web/20171113231705/https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks - https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=NSrpcservers author: Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT) date: 2018-03-20 modified: 2024-12-03 tags: - attack.persistence - attack.defense-impairment - attack.t1685 - attack.t1112 logsource: product: windows category: registry_event detection: selection_regkey: TargetObject|contains|all: - SYSTEM\ - ControlSet - \Control\Lsa selection_value_lmcompatibilitylevel: TargetObject|endswith: \lmcompatibilitylevel Details: - DWORD (0x00000000) - DWORD (0x00000001) - DWORD (0x00000002) selection_value_ntlmminclientsec: TargetObject|endswith: \NtlmMinClientSec Details: - DWORD (0x00000000) - DWORD (0x00000010) - DWORD (0x00000020) - DWORD (0x00000030) selection_value_restrictsendingntlmtraffic: TargetObject|endswith: \RestrictSendingNTLMTraffic condition: selection_regkey and 1 of selection_value_* falsepositives: - Services or tools that set the values to more restrictive values level: high
Near-miss passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 id: 225274c4-8dd1-40db-9e09-71dff4f6fb3c status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🔸 - 🔹 - 🔶 - 🔷 - 🔳 - 🔲 - ▪️ - ▫️ - ◾️ - ◽️ - ◼️ - ◻️ - 🟥 - 🟧 - 🟨 - 🟩 - 🟦 - 🟪 - ⬛️ - ⬜️ - 🟫 - 🔈 - 🔇 - 🔉 - 🔊 - 🔔 - 🔕 - 📣 - 📢 - 👁‍🗨 - 💬 - 💭 - 🗯 - ♠️ - ♣️ - ♥️ - ♦️ - 🃏 - 🎴 - 🀄️ - 🕐 - 🕑 - 🕒 - 🕓 - 🕔 - 🕕 - 🕖 - 🕗 - 🕘 - 🕙 - 🕚 - 🕛 - 🕜 - 🕝 - 🕞 - 🕟 - 🕠 - 🕡 - 🕢 - 🕣 - 🕤 - 🕥 - 🕦 - 🕧✢ - ✣ - ✤ - ✥ - ✦ - ✧ - ★ - ☆ - ✯ - ✡︎ - ✩ - ✪ - ✫ - ✬ - ✭ - ✮ - ✶ - ✷ - ✵ - ✸ - ✹ - → - ⇒ - ⟹ - ⇨ - ⇾ - ➾ - ⇢ - ☛ - ☞ - ➔ - ➜ - ➙ - ➛ - ➝ - ➞ - ♠︎ - ♣︎ - ♥︎ - ♦︎ - ♤ - ♧ - ♡ - ♢ - ♚ - ♛ - ♜ - ♝ - ♞ - ♟ - ♔ - ♕ - ♖ - ♗ - ♘ - ♙ - ⚀ - ⚁ - ⚂ - ⚃ - ⚄ - ⚅ - 🂠 - ⚈ - ⚉ - ⚆ - ⚇ - 𓀀 - 𓀁 - 𓀂 - 𓀃 - 𓀄 - 𓀅 - 𓀆 - 𓀇 - 𓀈 - 𓀉 - 𓀊 - 𓀋 - 𓀌 - 𓀍 - 𓀎 - 𓀏 - 𓀐 - 𓀑 - 𓀒 - 𓀓 - 𓀔 - 𓀕 - 𓀖 - 𓀗 - 𓀘 - 𓀙 - 𓀚 - 𓀛 - 𓀜 - 𓀝🏳️ - 🏴 - 🏁 - 🚩 - 🏳️‍🌈 - 🏳️‍⚧️ - 🏴‍☠️ - 🇦🇫 - 🇦🇽 - 🇦🇱 - 🇩🇿 - 🇦🇸 - 🇦🇩 - 🇦🇴 - 🇦🇮 - 🇦🇶 - 🇦🇬 - 🇦🇷 - 🇦🇲 - 🇦🇼 - 🇦🇺 - 🇦🇹 - 🇦🇿 - 🇧🇸 - 🇧🇭 - 🇧🇩 - 🇧🇧 - 🇧🇾 - 🇧🇪 - 🇧🇿 - 🇧🇯 - 🇧🇲 - 🇧🇹 - 🇧🇴 - 🇧🇦 - 🇧🇼 - 🇧🇷 - 🇮🇴 - 🇻🇬 - 🇧🇳 - 🇧🇬 - 🇧🇫 - 🇧🇮 - 🇰🇭 - 🇨🇲 - 🇨🇦 - 🇮🇨 - 🇨🇻 - 🇧🇶 - 🇰🇾 - 🇨🇫 - 🇹🇩 - 🇨🇱 - 🇨🇳 - 🇨🇽 - 🇨🇨 - 🇨🇴 - 🇰🇲 - 🇨🇬 - 🇨🇩 - 🇨🇰 - 🇨🇷 - 🇨🇮 - 🇭🇷 - 🇨🇺 - 🇨🇼 - 🇨🇾 - 🇨🇿 - 🇩🇰 - 🇩🇯 - 🇩🇲 - 🇩🇴 - 🇪🇨 - 🇪🇬 - 🇸🇻 - 🇬🇶 - 🇪🇷 - 🇪🇪 - 🇪🇹 - 🇪🇺 - 🇫🇰 - 🇫🇴 - 🇫🇯 - 🇫🇮 - 🇫🇷 - 🇬🇫 - 🇵🇫 - 🇹🇫 - 🇬🇦 - 🇬🇲 - 🇬🇪 - 🇩🇪 - 🇬🇭 - 🇬🇮 - 🇬🇷 - 🇬🇱 - 🇬🇩 - 🇬🇵 - 🇬🇺 - 🇬🇹 - 🇬🇬 - 🇬🇳 - 🇬🇼 - 🇬🇾 - 🇭🇹 - 🇭🇳 - 🇭🇰 - 🇭🇺 - 🇮🇸 - 🇮🇳 - 🇮🇩 - 🇮🇷 - 🇮🇶 - 🇮🇪 - 🇮🇲 - 🇮🇱 - 🇮🇹 - 🇯🇲 - 🇯🇵 - 🎌 - 🇯🇪 - 🇯🇴 - 🇰🇿 - 🇰🇪 - 🇰🇮 - 🇽🇰 - 🇰🇼 - 🇰🇬 - 🇱🇦 - 🇱🇻 - 🇱🇧 - 🇱🇸 - 🇱🇷 - 🇱🇾 - 🇱🇮 - 🇱🇹 - 🇱🇺 - 🇲🇴 - 🇲🇰 - 🇲🇬 - 🇲🇼 - 🇲🇾 - 🇲🇻 - 🇲🇱 - 🇲🇹 - 🇲🇭 - 🇲🇶 - 🇲🇷 - 🇲🇺 - 🇾🇹 - 🇲🇽 - 🇫🇲 - 🇲🇩 - 🇲🇨 - 🇲🇳 - 🇲🇪 - 🇲🇸 - 🇲🇦 - 🇲🇿 - 🇲🇲 - 🇳🇦 - 🇳🇷 - 🇳🇵 - 🇳🇱 - 🇳🇨 - 🇳🇿 - 🇳🇮 - 🇳🇪 - 🇳🇬 - 🇳🇺 - 🇳🇫 - 🇰🇵 - 🇲🇵 - 🇳🇴 - 🇴🇲 - 🇵🇰 - 🇵🇼 - 🇵🇸 - 🇵🇦 - 🇵🇬 - 🇵🇾 - 🇵🇪 - 🇵🇭 - 🇵🇳 - 🇵🇱 - 🇵🇹 - 🇵🇷 - 🇶🇦 - 🇷🇪 - 🇷🇴 - 🇷🇺 - 🇷🇼 - 🇼🇸 - 🇸🇲 - 🇸🇦 - 🇸🇳 - 🇷🇸 - 🇸🇨 - 🇸🇱 - 🇸🇬 - 🇸🇽 - 🇸🇰 - 🇸🇮 - 🇬🇸 - 🇸🇧 - 🇸🇴 - 🇿🇦 - 🇰🇷 - 🇸🇸 - 🇪🇸 - 🇱🇰 - 🇧🇱 - 🇸🇭 - 🇰🇳 - 🇱🇨 - 🇵🇲 - 🇻🇨 - 🇸🇩 - 🇸🇷 - 🇸🇿 - 🇸🇪 - 🇨🇭 - 🇸🇾 - 🇹🇼 - 🇹🇯 - 🇹🇿 - 🇹🇭 - 🇹🇱 - 🇹🇬 - 🇹🇰 - 🇹🇴 - 🇹🇹 - 🇹🇳 - 🇹🇷 - 🇹🇲 - 🇹🇨 - 🇹🇻 - 🇻🇮 - 🇺🇬 - 🇺🇦 - 🇦🇪 - 🇬🇧 - 🏴󠁧󠁢󠁥󠁮󠁧󠁿 - 🏴󠁧󠁢󠁳󠁣󠁴󠁿 - 🏴󠁧󠁢󠁷󠁬󠁳󠁿 - 🇺🇳 - 🇺🇸 - 🇺🇾 - 🇺🇿 - 🇻🇺 - 🇻🇦 - 🇻🇪 - 🇻🇳 - 🇼🇫 - 🇪🇭 - 🇾🇪 - 🇿🇲 - 🇿🇼🫠 - 🫢 - 🫣 - 🫡 - 🫥 - 🫤 - 🥹 - 🫱 - 🫱🏻 - 🫱🏼 - 🫱🏽 - 🫱🏾 - 🫱🏿 - 🫲 - 🫲🏻 - 🫲🏼 - 🫲🏽