SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,541 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
Detects service ticket requests using RC4 encryption type
Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.
Detects update to a scheduled task event that contain suspicious keywords.
Detects remote service activity via remote access to the svcctl named pipe
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
User Logoff Event
Sigma
Detects a user log-off activity. Could be used for example to correlate information during forensic investigations
Locked Workstation
Sigma
Detects locked workstation session events that occur automatically after a standard period of inactivity.
Page 637 of 680