SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,612 copies16 likes160,613 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects usage of a PowerShell command to dump the live memory of a Windows machine
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Detects the execution of the 'esxcli' command with the 'system' flag, combined with 'get' or 'list' subcommands, to retrieve information about various system components on an ESXi host. This can include details about accounts, modules, NTP settings, and other system configurations.
Detects remote RPC calls to read information about scheduled tasks via AtScv
Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.
Detects remote RPC calls to get event log information via EVEN or EVEN6
Detects remote RPC calls to read information about scheduled tasks
Page 332 of 680