SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects command line parameters used by Koadic hack tool
Detects a JAVA process running with remote debugging allowing more than just localhost to connect
Detects when a user performs data exfiltration by using DataSvcUtil.exe
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin
Detects a Windows command line executable started from MMC
Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.
Detects a suspicious process spawning from an Outlook process.
Detects the Installation of a Exchange Transport Agent
This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
Page 173 of 680