SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
The data may also be sent to an alternate network location from the main command and control server.
The data may also be sent to an alternate network location from the main command and control server.
Detects the execution of PowerShell via the creation of a named pipe starting with PSHost
Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack
Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory
Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.
Detects Commandlet names from ShellIntel exploitation scripts.
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Detects suspicious Powershell code that execute COM Objects
Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
Page 613 of 680