SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,627 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan
Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan
Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan
Detects instances where an OpenCanary node has been targeted by a SYN port scan.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
detects BPFDoor .lock and .pid files access in temporary file storage facility
Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
Page 154 of 680