SigmaHQ Detections
@sigmaHQ12 followers122,468 downloads2,593 copies16 likes160,483 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations
Eventlog Cleared
Sigma
One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Windows services that got terminated for whatever reason
Detects important or interesting Windows services that got terminated for whatever reason
Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software
Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"
Detects the creation of a named file stream with the imphash of a well-known hack tool
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
Page 52 of 680