SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as
a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Detects usage of Gpg4win to encrypt files
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.
Page 614 of 680