SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,639 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.
Windows Pcap Drivers
Sigma
Detects Windows Pcap driver installation based on a list of associated .sys files.
Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)
Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
Page 173 of 680