SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Addition of domains is seldom and should be verified for legitimacy.
Detects potential attempts made to set the Directory Services Restore Mode administrator password.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.
Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode
Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)
Detects a ProcessHacker tool that elevated privileges to a very high level
Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands
Detects a service installed by a client which has PID 0 or whose parent has PID 0
Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task
Page 262 of 680