SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)
Detects password change for the computer's domain account or host principal via "ksetup.exe"
Detects password change for the logged-on user's via "ksetup.exe"
Use of OpenConsole
Sigma
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Detects process dump via legitimate sqldumper.exe binary
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Detects the stopping of a Windows service via the "net" utility.
Detects when an admin share is mounted using net.exe
Page 616 of 680