SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects Baby Shark C2 Framework default communication patterns
Java Payload Strings
Sigma
Detects possible Java payloads in web access logs
Detects path traversal exploitation attempts
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Detect standard users login that are part of high privileged groups such as the Administrator group
NTLM Brute Force
Sigma
Detects common NTLM brute force device names
RDP login with localhost source address may be a tunnelled login
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers
Page 598 of 680