SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,532 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)
Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.
Download and compress a remote file and store it in a cab file on local machine.
Download or Copy file with Extrac32
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Page 654 of 680