SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,476 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
Execution of ssh.exe to perform data exfiltration and tunneling through RDP
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
Detects events that appear when a user click on a link file with a powershell command in it
Detects potential network sniffing via use of network tools such as "tshark", "windump".
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution
Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.
Page 656 of 680