SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,505 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detect a system being shutdown or put into different boot mode
Cisco Local Accounts
Sigma
Find local accounts being created or modified as well as remote authentication configurations
Modifications to a config that will serve an adversary's impacts or persistence
Cisco Stage Data
Sigma
Various protocols maybe used to put data on the device for exfil or infil
NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>
APT User Agent
Sigma
Detects suspicious user agent strings used in APT malware in proxy logs
Detects suspicious user agent strings used by crypto miners in proxy logs
Hack Tool User Agent
Sigma
Detects suspicious user agent strings user by hack tools in proxy logs
Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.
Detects a failed installation of a Exchange Transport Agent
Page 165 of 680