SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,565 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.
Detects suspicious powershell command line parameters used in Empire
Detects the use of Jlaive to execute assemblies in a copied PowerShell
Detects the use of KrbRelay, a Kerberos relaying tool
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored
Detects usage of the Sharp Chisel via the commandline arguments
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Detects process activity patterns as seen being used by Sliver C2 framework implants
Use of hostname to get information
Page 617 of 680