SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,525 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity
Adversaries may target user email on local systems to collect sensitive information.
Files containing email data can be acquired from a users local system, such as Outlook storage or cache files.
Files containing email data can be acquired from a users local system, such as Outlook storage or cache files.
Once established within a system or network, an adversary may use automated techniques for collecting internal data
Powershell Timestomp
Sigma
Adversaries may modify file time attributes to hide new or changes to existing files.
Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.
Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.
Page 676 of 680