SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,639 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of NirCmd tool for command execution as SYSTEM user
Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts
Detects the export of a crital Registry key to a file.
Detects the export of the target Registry key to a file.
Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
Detects suspicious print spool service (spoolsv.exe) child processes.
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe
Detects the use of SDelete to erase a file not the free space
Page 175 of 680