SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Alerts on Metasploit host's authentications on the domain.
Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers
Detects handle requests and access operations to specific registry keys to calculate the SysKey
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
Detects RemCom service installation and execution events
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
Detects network connections from the Equation Editor process "eqnedt32.exe".
Detects well-known credential dumping tools execution via specific named pipe creation
Page 599 of 680