SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,587 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
Identifies when a DNS Zone is modified or deleted in Google Cloud.
Detects when the file "passwd" or "shadow" is copied from tmp path
Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location
Detects the enumeration of other remote systems.
Detects system information discovery commands
Detects usage of the "usermod" binary to add users add users to the root or suoders groups
Malware User Agent
Sigma
Detects suspicious user agent strings used by malware in proxy logs
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.
Page 597 of 680