SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,541 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Rule to detect the Hybrid Connection Manager service running on an endpoint.
Detects suspicious application installed by looking at the added shortcut to the app resolver cache
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
Detects volume shadow copy mount via Windows event log
Windows Update Error
Sigma
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
This the exploitation of a NTFS vulnerability as reported without many details via Twitter
Detects the use of smbexec.py tool by detecting a specific service installation
Detects well-known credential dumping tools execution via service execution events
Detects powershell script installed as a Service
Detects CSExec service installation and execution events
Page 638 of 680