SigmaHQ Detections
@sigmaHQ12 followers122,468 downloads2,593 copies16 likes160,483 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.
Detects update to a scheduled task event that contain suspicious keywords.
Detects remote service activity via remote access to the svcctl named pipe
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
User Logoff Event
Sigma
Detects a user log-off activity. Could be used for example to correlate information during forensic investigations
Locked Workstation
Sigma
Detects locked workstation session events that occur automatically after a standard period of inactivity.
Rule to detect the Hybrid Connection Manager service running on an endpoint.
Detects suspicious application installed by looking at the added shortcut to the app resolver cache
Detects volume shadow copy mount via Windows event log
Windows Update Error
Sigma
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
Page 634 of 680