SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects source code enumeration that use GET requests by keyword searches in URL strings
Detects the Installation of a Exchange Transport Agent
Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.
Windows Pcap Drivers
Sigma
Detects Windows Pcap driver installation based on a list of associated .sys files.
Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service
Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)
Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet
Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
Page 172 of 680