SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,505 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Detects active directory enumeration activity using known AdFind CLI flags
Detects AdFind execution with common flags seen used during attacks
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
Hides the file extension through modification of the registry
PwnDrp Access
Sigma
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
Detects logons using NTLM to hosts that are potentially not part of the domain.
Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values
Finger.EXE Execution
Sigma
Detects execution of the "finger.exe" utility.
Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon.
Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.
Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon.
Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.
Detects possible malicious execution of JXA in-memory via OSAScript
Page 164 of 680