SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,543 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
Detects a segmentation fault error message caused by a crashing apache worker process
Detects suspicious malformed user agent strings in proxy logs
Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"
JNDIExploit Pattern
Sigma
Detects exploitation attempt using the JNDI-Exploit-Kit
Ntdsutil Abuse
Sigma
Detects potential abuse of ntdsutil to dump ntds.dit database
Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location
Page 632 of 680