SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,581 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Detects path traversal exploitation attempts
Detect standard users login that are part of high privileged groups such as the Administrator group
NTLM Brute Force
Sigma
Detects common NTLM brute force device names
RDP login with localhost source address may be a tunnelled login
Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
Detects RemCom service installation and execution events
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Page 601 of 680