SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the presence of a loaded unsigned kernel module on the system.
Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability
Detects DNS queries for subdomains related to MEGA sharing website
USB Device Plugged
Sigma
Detects plugged/unplugged USB devices
Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it
Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
Detects read access to a domain user from a non-machine account
Detects access to ADMIN$ network share
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
Detects external disk drives or plugged-in USB devices.
Page 608 of 680