SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of whoami that has been renamed to a different name to avoid detection
Detects service principal name (SPN) enumeration used for Kerberoasting
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Detects command line parameters or strings often used by crypto miners
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
Detects WmiPrvSE spawning a process
Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
Detects SQL error messages that indicate probing for an injection attack
Identifies when an EKS cluster is created or deleted.
Page 601 of 680