SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity
Detects the use of NirCmd tool for command execution as SYSTEM user
Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts
Detects the export of a crital Registry key to a file.
Detects the export of the target Registry key to a file.
Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
Detects suspicious print spool service (spoolsv.exe) child processes.
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe
Page 174 of 680