SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Detects suspicious ways to run Invoke-Execution using IEX alias
Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders
Detects common commands used in Windows webshells
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths
Detection of unusual child processes by different system processes
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detects suspicious process patterns used in NTDS.DIT exfiltration
Page 676 of 680