SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,477 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.
Detects SILENTTRINITY stager use via PE metadata
Detects execution of the IEExec utility to download and execute files
Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.
Download and compress a remote file and store it in a cab file on local machine.
Download or Copy file with Extrac32
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
Page 649 of 680