SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,776 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation
Identifies when a Azure Kubernetes network policy is modified or deleted.
Detects buffer overflow attempts in Unix system log files
Detects suspicious log entries in Linux log files
Detects when Kubernetes Secrets are Modified or Deleted.
Detects when an account successfully recovers a Local Administrator Password Solution (LAPS) password from Microsoft Entra ID. This activity is logged in Azure audit logs under the 'Device' category with the activity type 'Recover device local administrator password' and additional details indicating 'Successfully recovered local credential by device id'. This event can signify an attacker attempting to gain elevated privileges or maintain persistence by obtaining local administrator credentials.
Page 332 of 680