SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,476 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Identifies when a service principal is created in Azure.
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls
Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself.
Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.
Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.
Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon
Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses
Detects process creation events where the Image field lacks an absolute path,
which occurs when the backing file no longer exists on disk at the time of
logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.
which occurs when the backing file no longer exists on disk at the time of
logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.
User Added to an Administrator's Azure AD Role
Identifies when a application is deleted in Azure.
Identifies when a device in azure is no longer managed or compliant
Identifies when a service principal was removed in Azure.
Page 26 of 680