SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE
Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)
Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)
Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Psexec Execution
Sigma
Detects user accept agreement execution in psexec commandline
Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
Detection well-known mimikatz command line arguments
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc
Detects the attempt to create a process via "wmic" with the "process call create" flag, which might
indicate an attempt to execute a malicious process on the compromised host. Adversaries may use
wmic to execute a process on the compromised host as part of their attack. This event is triggered on
on attempt and process creation can be either successful or unsuccessful.
indicate an attempt to execute a malicious process on the compromised host. Adversaries may use
wmic to execute a process on the compromised host as part of their attack. This event is triggered on
on attempt and process creation can be either successful or unsuccessful.
Page 670 of 680