SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,575 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Detects java process spawning suspicious children
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
Detects usage of "xterm" as a potential reverse shell tunnel
JAMF MDM Execution
Sigma
Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.
Detects usage of "find" binary in a suspicious manner to perform discovery
Cisco Collect Data
Sigma
Collect pertinent data from the configuration files
Detects strings used in command execution in DNS TXT Answer
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
Page 608 of 680