SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1
Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information
Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment
Detects the use of Advanced Port Scanner.
Detects suspicious command line reg.exe tool adding key to RUN key in Registry
Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.
Detects the stopping of a Windows service via the "sc.exe" utility
Sysmon registry detection of a local hidden user account.
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification
Page 169 of 680