SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,530 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects scheduled task creation events that include suspicious actions, and is run once at 00:00
Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Use of the commandline to shutdown or reboot windows
Detects the rare use of the command line tool shutdown to logoff a user
Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)
Detect attacker collecting audio via SoundRecorder application.
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
Execution of ssh.exe to perform data exfiltration and tunneling through RDP
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
Page 661 of 680