SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
Detects Commandlet names and arguments from the Nishang exploitation framework
PowerShell SAM Copy
Sigma
Detects suspicious PowerShell scripts accessing SAM hives
Detects files dropped by Winnti as described in RedMimicry Winnti playbook
Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains
Commandline to launch powershell with a base64 payload
Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system
Detects the creation of doas.conf file in linux host platform.
Page 673 of 680