SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,477 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Suspicious Git Clone
Sigma
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.
Detects execution of the Notepad++ updater (gup) to launch other commands or executables
Detects use of Cobalt Strike commands accidentally entered in the CMD shell
Detects Cobalt Strike module/commands accidentally entered in CMD shell
Detects potential process patterns related to Cobalt Strike beacon activity
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)
Detects the execution of the hacktool SafetyKatz via PE information and default Image name
Detects the execution of SecurityXploded Tools
Page 648 of 680