SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,477 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious renamed SysInternals DebugView execution
Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators
Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service
Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.
Detects scheduled task creation events that include suspicious actions, and is run once at 00:00
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Use of the commandline to shutdown or reboot windows
Detects the rare use of the command line tool shutdown to logoff a user
Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)
Detect attacker collecting audio via SoundRecorder application.
Page 655 of 680