SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,543 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects loaded unsigned image on the system
Detects loaded kernel modules that did not meet the WHQL signing requirements.
Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Detects when a DNS zone transfer failed.
Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log
Detects the default "UserName" used by the DiagTrackEoP POC
Detects successful logon attempts performed with WMI
Page 634 of 680