SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,777 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Detects the creation of the default output filename used by the wmiexec tool
Detects usage of a PowerShell command to dump the live memory of a Windows machine
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Detects the execution of the 'esxcli' command with the 'system' flag, combined with 'get' or 'list' subcommands, to retrieve information about various system components on an ESXi host. This can include details about accounts, modules, NTP settings, and other system configurations.
Detects remote RPC calls to read information about scheduled tasks via AtScv
Page 335 of 680