SigmaHQ Detections
@sigmaHQ12 followers122,468 downloads2,593 copies16 likes160,483 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
An application has been removed. Check if it is critical.
Detects MSI package installation from suspicious locations
Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role
Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started
Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
Detects when an application acquires a certificate private key
Detects block events for files that are disallowed by code integrity for protected processes
Detects the load of a revoked kernel driver
Detects loaded unsigned image on the system
Page 630 of 680