SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,477 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious mshta process execution patterns
Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.
Detects RDP session hijacking by using MSTSC shadowing
Detects the usage of the "net.exe" command to start a service using the "start" flag
Detects when an internet hosted webdav share is mounted using the "net.exe" utility
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Identifies the creation of local users via the net.exe command.
Detects the execution of netsh with the "trace" flag in order to start a network capture
Detect the harvesting of wifi credentials using netsh.exe
Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
Page 650 of 680