SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,634 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1
Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID
Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results.
This detection focuses on the keywords that the attacker might use as a filter.
This detection focuses on the keywords that the attacker might use as a filter.
Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information
Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment
Detects the use of Advanced Port Scanner.
Detects suspicious command line reg.exe tool adding key to RUN key in Registry
Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.
Detects the stopping of a Windows service via the "sc.exe" utility
Page 169 of 680