SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators
This the exploitation of a NTFS vulnerability as reported without many details via Twitter
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity
Adversaries may target user email on local systems to collect sensitive information.
Files containing email data can be acquired from a users local system, such as Outlook storage or cache files.
Files containing email data can be acquired from a users local system, such as Outlook storage or cache files.
Page 674 of 680