SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against
Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.
Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Detects presence of a potentially xor encoded powershell command
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Page 672 of 680