SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,477 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects usage of bitsadmin downloading a file from a suspicious domain
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe
Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts
Detects the execution of WMIC in order to get a list of firewall and antivirus products
Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts
Detects the download of suspicious file type from a well-known file and paste sharing domain
Local accounts, System Owner/User discovery using operating systems utilities
Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.
Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information
Page 30 of 680