SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,494 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Exports the target Registry key and hides it in the specified alternate data stream.
Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence
Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence
Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.
Page 102 of 680