SigmaHQ Detections
@sigmaHQ12 followers122,467 downloads2,593 copies16 likes160,481 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.
Detects when the "Windows Defender Threat Protection" service is disabled.
Detects important or interesting Windows services that got terminated unexpectedly.
Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"
Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
Detects the download of suspicious file type from URLs with IP
Detects potential DLL side loading of DLLs that are part of the Wazuh security platform
Page 44 of 680