SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,473 copies16 likes159,597 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects uncommon processes creating remote threads.
Detects uncommon processes creating remote threads.
Detects uncommon target processes for remote thread creation
Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers
Exports the target Registry key and hides it in the specified alternate data stream.
Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence
Page 97 of 680