SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Detects blocked load attempts of revoked drivers
Detects activity when a member is added to a security-enabled global group
Detects activity when a member is removed from a security-enabled global group
Detects activity when a security-enabled global group is deleted
Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
Page 257 of 680