SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,541 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Rule to detect the Hybrid Connection Manager service installation.
Detects execution of Impacket's psexec.py.
Detect AD credential dumping using impacket secretdump HKTL
ISO Image Mounted
Sigma
Detects the mount of an ISO image on an endpoint
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
Detects when the password policy is enumerated.
Detect PetitPotam coerced authentication activity.
Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.
Page 636 of 680