SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,545 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity
This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.
Detects Windows services that got terminated for whatever reason
Detects remote thread creation from CACTUSTORCH as described in references.
Detects a remote thread creation of Ttdinject.exe used as proxy
Detects the creation of a named file stream with the imphash of a well-known hack tool
Detects the download of a file with a potentially suspicious extension from a .zip top level domain.
Detects DNS queries initiated by "Regsvr32.exe"
SCR File Write Event
Sigma
Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.
Page 60 of 680