SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,532 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)
Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool
Detects the execution of the PurpleSharp adversary simulation tool
Detects usage of the Quarks PwDump tool via commandline arguments
Detects the execution of the hacktool SafetyKatz via PE information and default Image name
Detects the execution of SecurityXploded Tools
Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.
Detects SILENTTRINITY stager use via PE metadata
Detects execution of the IEExec utility to download and execute files
Page 653 of 680