MITRE ATT&CK technique
Endpoint Denial of Service detection rulesT1499
Endpoint Denial of Service (T1499) is a MITRE ATT&CK technique in the Impact tactic. This page lists the 7 community-maintained Sigma detection rules in the library mapped to T1499 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux.
Audit CVE Event
criticalDetects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.
windows
Apache Segmentation Fault
highDetects a segmentation fault error message caused by a crashing apache worker process
CVE-2024-49113 Exploitation Attempt - LDAP Nightmare
highDetects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".
windows
LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089
highDetects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.
windows
Nginx Core Dump
highDetects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
NTFS Vulnerability Exploitation
highThis the exploitation of a NTFS vulnerability as reported without many details via Twitter
windows
Potential Abuse of Linux Magic System Request Key
mediumDetects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
linux