SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
Detects execution of the hacktool NetExec.
NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration
In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems.
Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration
In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems.
Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan
Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan
Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan
Detects instances where an OpenCanary node has been targeted by a SYN port scan.
detects BPFDoor .lock and .pid files access in temporary file storage facility
Page 154 of 680