SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,532 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Detects programs that connect to uncommon destination ports
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.
Detects default CSExec pipe creation
Detects the WMI Event Consumer service scrcons.exe creating a named pipe
Shadow Copies deletion using operating systems utilities via PowerShell
Detects remote PowerShell sessions
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Page 645 of 680