SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,532 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Well-known DNS Exfiltration tools execution
Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Attackers may leverage fsutil to enumerated connected drives.
Suspicious Git Clone
Sigma
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.
Detects execution of the Notepad++ updater (gup) to launch other commands or executables
Detects use of Cobalt Strike commands accidentally entered in the CMD shell
Detects Cobalt Strike module/commands accidentally entered in CMD shell
Detects potential process patterns related to Cobalt Strike beacon activity
Detects suspicious process patterns found in logs when CrackMapExec is used
Page 652 of 680