SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,532 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of a new bits job by Bitsadmin
Detect remote login by Administrator user (depending on internal pattern).
Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.
Detects when the "Windows Defender Threat Protection" service is disabled.
Detects important or interesting Windows services that got terminated unexpectedly.
Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
Page 36 of 680