SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Detects NetNTLM downgrade attack
Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.
Detects DCShadow via create new SPN
Detects svchost hosting RDP termsvcs communicating with the loopback address
Page 98 of 680