SigmaHQ Detections
@sigmaHQ12 followers122,472 downloads2,593 copies16 likes160,491 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects backup catalog deletions
Detects restricted access to applications by the Software Restriction Policies (SRP) policy
Detects an appx package deployment that was blocked by AppLocker policy.
Detects the creation of a new bits job by PowerShell
Detects a BITS transfer job downloading file(s) from a direct IP address.
Detects activity when The Windows Defender Firewall service failed to load Group Policy
Detects activity when Windows Defender Firewall has been reset to its default configuration
Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.
Page 65 of 680