SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,531 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detect the harvesting of wifi credentials using netsh.exe
Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
Detect use of PDQ Deploy remote admin tool
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Execution of plink to perform data exfiltration and tunneling
Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.
Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.
Page 656 of 680