SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,565 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of PowerShell via the creation of a named pipe starting with PSHost
Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack
Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory
Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.
Detects Commandlet names from ShellIntel exploitation scripts.
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Detects suspicious Powershell code that execute COM Objects
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as
a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Page 615 of 680