SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,575 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/
WebDav Put Request
Sigma
A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Detects an issue in apache logs that reports threading related errors
Nginx Core Dump
Sigma
Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Detects WebDav DownloadCradle
Detects suspicious encoded User-Agent strings, as seen used by some malware.
Detects potential SQL injection attempts via GET requests in access logs.
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Detects blocked image load events with revoked certificates by code integrity.
Page 609 of 680