SigmaHQ Detections
@sigmaHQ12 followers122,468 downloads2,593 copies16 likes160,483 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs
Detects certificate creation with template allowing risk permission subject
Detects certificate creation with template allowing risk permission subject and risky EKU
Potential adversaries accessing the microphone and webcam in an endpoint.
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
Detects an installation of a device that is forbidden by the system policy
Detects the creation of a local hidden user account which should not happen for event ID 4720.
Rule to detect the Hybrid Connection Manager service installation.
Detects execution of Impacket's psexec.py.
Detect AD credential dumping using impacket secretdump HKTL
Page 632 of 680