SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Uses the .NET InstallUtil.exe application in order to execute image without log
MsiExec Web Install
Sigma
Detects suspicious msiexec process starts with web addresses as parameter
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Detects a segmentation fault error message caused by a crashing apache worker process
Detects file writes of WMI script event consumer
Detects WMI command line event consumers
Interactive AT Job
Sigma
Detects an interactive AT job, which may be used as a form of privilege escalation.
A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.
Detects creation of WMI event subscription persistence method
Detects the modification of an EC2 snapshot's permissions to enable access from another account
Page 680 of 680