SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,551 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects WmiPrvSE spawning a process
Detects value modification of registry key containing path to binary used as screensaver.
Alerts on trust record modification within the registry, indicating usage of macros
Detects Processes accessing the camera and microphone from suspicious folder
Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.
Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
Detects suspicious Django web application framework exceptions that could indicate exploitation attempts
Generic rule for SQL exceptions in Python according to PEP 249
Page 622 of 680