SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,632 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects usage of "cmdkey.exe" to add generic credentials.
As an example, this can be used before connecting to an RDP session via command line interface.
As an example, this can be used before connecting to an RDP session via command line interface.
Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers
Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.
Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Detects active directory enumeration activity using known AdFind CLI flags
Detects AdFind execution with common flags seen used during attacks
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
Hides the file extension through modification of the registry
PwnDrp Access
Sigma
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
Detects logons using NTLM to hosts that are potentially not part of the domain.
Page 164 of 680