SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a potentially suspicious execution of a process located in the '/tmp/' folder
Detects suspicious interactive bash as a parent to rather uncommon child processes
Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell
Detects usage of the "touch" process in service file.
Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges
Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script
Detects disabling security tools
Detects the execution of the nscurl utility in order to download files.
Detects when the macOS Script Editor utility spawns an unusual child process.
Detects attempts to create and add an account to the admin group via "sysadminctl"
Page 93 of 680