SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,538 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file
Detects default lsass dump filename generated by SafetyKatz.
Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials
Detects javaw.exe in AppData folder as used by Adwind / JRAT
NTDS.DIT Created
Sigma
Detects creation of a file named "ntds.dit" (Active Directory Database)
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory
Page 641 of 680