SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,538 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the addition of a new module to an IIS server.
Detects the removal of a previously installed IIS module.
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
Detects the attack technique pass the hash which is used to move laterally inside the network
One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.
Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool
Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations
Page 44 of 680