SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential execution of MeshAgent, a remote access tool, by looking for the '--meshServiceName' argument in the command line. Threat actors often rename the MeshAgent binary to evade detection, making this command-line argument a more reliable indicator of its use for remote access.
Detects the use of the "capsh" utility to invoke a shell.
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled".
Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
Detects the execution of the hdiutil utility in order to create a disk image.
Detects the execution of the BCP utility in order to export data from the database.
Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.
Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.
Detects PowerShell creating a binary executable or a script file.
Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods
Detects changes and updates to the user risk and MFA registration policy.
Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.
Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.
Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function.
This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Page 307 of 680