SigmaHQ Detections
@sigmaHQ12 followers122,468 downloads2,593 copies16 likes160,483 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Detects enumeration of local system groups
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
Detects the enumeration of other remote systems.
Detects usage of system utilities (only grep for now) to discover security software discovery
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.
Detects potential suspicious applet or osascript executing "osacompile".
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
Page 628 of 680