SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,476 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potentially suspicious explicit credential logon events where the user
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)
Detects potentially suspicious loading of the Offline Registry Library (offreg.dll).
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.
Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
Detects initiated network connections to crypto mining pools
Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
Detects loading of essential DLLs used by PowerShell by non-PowerShell process.
Detects behavior similar to meterpreter's "load powershell" extension.
Detects behavior similar to meterpreter's "load powershell" extension.
Page 22 of 680