Vendor advisory

www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a

Published on: www.cisa.gov
Sources in this catalogue: 2

ATT&CK techniques those detections carry

T1074.001Local Data Staging
T1112Modify Registry
T1087Account Discovery
T1003.004LSA Secrets
T1033System Owner/User Discovery
T1057Process Discovery
T1087.001Local Account
T1087.002Domain Account
+2 more

16 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Windows System User Privilege Discovery	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Process Commandline Discovery	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Modify Registry Disable Restricted Admin	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows LSA Secrets NoLMhash Registry	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Known GraphicalProton Loaded Modules	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Domain Account Discovery Via Get-NetComputer	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Archive Collected Data via Powershell	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Account Discovery With NetUser PreauthNotRequire	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Account Discovery for Sam Account Name	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Account Discovery for None Disable User Account	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Enable LM Hash Storage	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Enable LM Hash Storage - ProcCreation	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Zip A Folder With PowerShell For Staging In Temp - PowerShell Script	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Zip A Folder With PowerShell For Staging In Temp - PowerShell Module	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Zip A Folder With PowerShell For Staging In Temp - PowerShell	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 16 of 16

Filter in the catalogue