SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,723 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects remote RPC calls to create or execute a scheduled task via SASec
Detects activity when someone is changing passwords on behalf of other users.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Modifying Crontab
Sigma
Detects suspicious modification of crontab file.
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Page 258 of 680