SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,579 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects service principal name (SPN) enumeration used for Kerberoasting
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Detects command line parameters or strings often used by crypto miners
Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
Detects SQL error messages that indicate probing for an injection attack
Identifies when an EKS cluster is created or deleted.
Page 603 of 680