SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,639 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a JAVA process running with remote debugging allowing more than just localhost to connect
Detects when a user performs data exfiltration by using DataSvcUtil.exe
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin
Detects a Windows command line executable started from MMC
Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.
Detects a suspicious process spawning from an Outlook process.
Detects the Installation of a Exchange Transport Agent
This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity
Page 174 of 680