SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,543 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
An application has been removed. Check if it is critical.
Detects MSI package installation from suspicious locations
Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role
Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started
Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
Detects when an application acquires a certificate private key
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.
Detects block events for files that are disallowed by code integrity for protected processes
Detects the load of a revoked kernel driver
Page 633 of 680