SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,565 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
Detects password change for the computer's domain account or host principal via "ksetup.exe"
Detects password change for the logged-on user's via "ksetup.exe"
Use of OpenConsole
Sigma
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Detects process dump via legitimate sqldumper.exe binary
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Detects when an admin share is mounted using net.exe
Detects when a share is mounted using the "net.exe" utility
Page 618 of 680