SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,735 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
Detects the use of PowerShell modules and cmdlets to gather local group information.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Detects the use of PowerShell modules and cmdlets to gather local group information.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Detects DNS resolution of an .onion address related to Tor routing networks
Detects DNS queries to an ".onion" address related to Tor routing networks
Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).
This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.
This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.
Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Page 283 of 680