SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,531 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious mshta process execution patterns
Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.
Detects RDP session hijacking by using MSTSC shadowing
Detects the usage of the "net.exe" command to start a service using the "start" flag
Detects the stopping of a Windows service via the "net" utility.
Detects when an internet hosted webdav share is mounted using the "net.exe" utility
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Identifies the creation of local users via the net.exe command.
Detects the execution of netsh with the "trace" flag in order to start a network capture
Detect the harvesting of wifi credentials using netsh.exe
Page 655 of 680