SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects usage of "find" binary in a suspicious manner to perform discovery
Detects system information discovery commands
Detects usage of the "usermod" binary to add users add users to the root or suoders groups
Detects attempts to use screencapture to collect macOS screenshots
Detection use of the command "split" to split files into parts and possible transfer.
Malware User Agent
Sigma
Detects suspicious user agent strings used by malware in proxy logs
Detects keywords from well-known PowerShell exploitation frameworks
Detects command line parameters used by Hydra password guessing hack tool
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Page 594 of 680