SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,618 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced
Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting
Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Detects the use of SharpUp, a tool for local privilege escalation
Page 123 of 680