SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,634 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious command sequence that JexBoss
Detects possible malicious execution of JXA in-memory via OSAScript
Detects potential suspicious run-only executions compiled using OSACompile
Detect a system being shutdown or put into different boot mode
See what commands are being input into the device by other people, full credentials can be in the history
Cisco Local Accounts
Sigma
Find local accounts being created or modified as well as remote authentication configurations
Modifications to a config that will serve an adversary's impacts or persistence
Cisco Stage Data
Sigma
Various protocols maybe used to put data on the device for exfil or infil
Cisco Sniffing
Sigma
Show when a monitor or a span/rspan is setup or modified
Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
Page 171 of 680