SigmaHQ Detections
@sigmaHQ12 followers122,472 downloads2,593 copies16 likes160,491 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a suspicious RDP session redirect using tscon.exe
Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
When configured with suitable command line arguments, w32tm can act as a delay mechanism
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.
Detects the use of Windows Credential Editor (WCE)
Detects value modification of registry key containing path to binary used as screensaver.
Alerts on trust record modification within the registry, indicating usage of macros
Detects Processes accessing the camera and microphone from suspicious folder
Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.
Page 620 of 680