SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of Jlaive to execute assemblies in a copied PowerShell
Detects the use of KrbRelay, a Kerberos relaying tool
Detects the execution of the PurpleSharp adversary simulation tool
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored
Detects usage of the Sharp Chisel via the commandline arguments
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Detects process activity patterns as seen being used by Sliver C2 framework implants
Use of hostname to get information
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors
Page 615 of 680