SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,586 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Identifies when sensitive information is re-identified in google Cloud.
Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.
Detects shellshock expressions in log files
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
Detects the creation of a new named pipe using the "mkfifo" utility
Detects usage of "find" binary in a suspicious manner to perform discovery
Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
Detects execution of shells from a parent process located in a temporary (/tmp) directory
Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.
Detects the usage of tooling to sniff network traffic.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Page 599 of 680