ATT&CK library

Every technique, with the rule that catches it

Not another glossary. Each page shows what a real attack looks like in your telemetry, the exact Sigma and Wazuh detections, and a live Tyrian range where you can run it and watch the rule fire.

Credential AccessDefense EvasionExecutionImpactInitial AccessLateral MovementPersistencePrivilege Escalation
T1558.003

Kerberoasting

Kerberoasting lets any domain user request a crackable ticket for a service account, then brute-force its password offline. Here is exactly what it looks like in your logs and the Sigma and Wazuh rules that catch it.

Credential Access
T1486

Data Encrypted for Impact

The final stage of a ransomware intrusion: mass file encryption. By the time files are locked it is late, but the encryption burst itself is detectable. Here is the behavior and the rules that catch it early.

Impact
T1003.001

LSASS Memory Dumping

LSASS holds the credentials of everyone logged into a Windows host. Dumping its memory is the classic credential-theft step. Here is the handle-access signature and the rules that catch it.

Credential Access
T1021.002

SMB / Windows Admin Shares

Once an attacker has admin credentials, SMB admin shares (ADMIN$, C$) are the highway to the rest of the domain. This is the classic PsExec move, and one of the most commonly missed. Here is how to catch it.

Lateral Movement
T1566.001

Spearphishing Attachment

The front door of most intrusions: a document that spawns a script host. The email is hard to catch reliably; the process lineage it creates is not. Here is the parent-child signature and the rules.

Initial Access
T1550.002

Pass the Hash

Once an attacker has an NTLM hash, they don't need to crack it, they authenticate with it directly. Here is the logon signature Pass-the-Hash leaves and the rules that catch it.

Lateral MovementDefense Evasion
T1110.003

Password Spraying

Instead of many passwords against one account (which locks it), spraying tries one common password against many accounts. Here is the failed-logon signature and the rules that catch it before it succeeds.

Credential Access
T1053.005

Scheduled Task Persistence

A scheduled task is a quiet, reliable way to survive a reboot and re-launch a payload. Here is what task creation looks like in your logs and the rules that flag the malicious ones.

PersistenceExecutionPrivilege Escalation

The rules are free. Take them.

Every detection here ships in the open-source Tyrian Detection Pack: 67 Sigma rules across 64 ATT&CK techniques, Windows and Linux, compiled to Wazuh, Splunk and Sentinel, with an ATT&CK Navigator layer and a command that fires each one. MIT licensed. Clone it, drop it into your SIEM, then prove it works on a real range.

Get the Detection Pack