SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,593 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects application popup reporting a failure of the Sysmon service
Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.
Detects denied requests by Active Directory Certificate Services.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Page 95 of 680