SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,629 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service).
This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.
This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.
Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings
Detects file downloads directly from IP address URL using curl.exe
Detects potentially suspicious file downloads directly from IP addresses using curl.exe
Detects execution of "curl.exe" with the "--insecure" flag.
Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH.
Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.
Page 157 of 680