SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects email exfiltration via powershell cmdlets
Detects usage of the 'Get-Clipboard' cmdlet via CLI
Detects suspicious powershell invocations from interpreters or unusual programs
Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Detects usage of the Chisel tunneling tool via the commandline arguments
Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera
Use of reg to get MachineGuid information
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Page 618 of 680