SigmaHQ Detections
@sigmaHQ12 followers122,467 downloads2,593 copies16 likes160,481 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects programs that connect to uncommon destination ports
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.
Detects default CSExec pipe creation
Detects the WMI Event Consumer service scrcons.exe creating a named pipe
Shadow Copies deletion using operating systems utilities via PowerShell
Detects remote PowerShell sessions
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Page 641 of 680