Query: Sigma YAML for azure / riskdetection
Matching passage: Sigma rule: Indicates that a password spray attack has been successfully performed.. Logsource: azure / riskdetection. Rule: title: Password Spray Activity id: 28ecba0a-c743-4690-ad29-9a8f6f25a6f9 status: test description: Indicates that a password spray attack has been successfully performed. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1110 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: passwordSpray condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the. Logsource: windows / registry_set. Rule: title: Register New IFiltre For Persistence id: b23818c7-e575-4d13-8012-332075ec0a2b status: test description: 'Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files. ' references: - https://persistence-info.github.io/Data/ifilters.html - https://twitter.com/0gtweet/status/1468548924600459267 - https://github.com/gtworek/PSBits/tree/master/IFilter - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2024-03-26 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection_ext: TargetObject|contains|all: - \SOFTWARE\Classes\. - \PersistentHandler selection_clsid: TargetObject|contains|all: - \SOFTWARE\Classes\CLSID - \PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF} filter_default_targets: TargetObject|contains: - \CLSID\{4F46F75F-199F-4C63-8B7D-86D48FE7970C}\ - \CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\ - \CLSID\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\ - \CLSID\{72773E1A-B711-4d8d-81FA-B9A43B0650DD}\ - \CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\ - \CLSID\{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}\ - \CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\ - \CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\ - \CLSID\{3B224B11-9363-407e-850F-C9E1FFACD8FB}\ - \CLSID\{3DDEB7A4-8ABF-4D82-B9EE-E1F4552E95BE}\ - \CLSID\{5645C8C1-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{5645C8C4-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{58A9EBF6-5755-4554-A67E-A2467AD1447B}\ - \CLSID\{5e941d80-bf96-11cd-b579-08002b30bfeb}\ - \CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\ - \CLSID\{7E9D8D44-6926-426F-AA2B-217A819A5CCE}\ - \CLSID\{8CD34779-9F10-4f9b-ADFB-B3FAEABDAB5A}\ - \CLSID\{9694E38A-E081-46ac-99A0-8743C909ACB6}\ - \CLSID\{98de59a0-d175-11cd-a7bd-00006b827d94}\ - \CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\ - \CLSID\{B4132098-7A03-423D-9463-163CB07C151F}\ - \CLSID\{d044309b-5da6-4633-b085-4ed02522e5a5}\ - \CLSID\{D169C14A-5148-4322-92C8-754FC9D018D8}\ - \CLSID\{DD75716E-B42E-4978-BB60-1497B92E30C4}\ - \CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}\ - \CLSID\{E772CEB3-E203-4828-ADF1-765713D981B8}\ - \CLSID\{eec97550-47a9-11cf-b95