SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
Detects PowerShell core DLL being loaded by an Office Product
Detects potential DLL sideloading of "7za.dll"
Detects potential DLL sideloading of "appverifUI.dll"
Detects potential DLL sideloading of "AVKkid.dll"
Detects potential DLL sideloading of "CCleanerDU.dll"
Detects potential DLL sideloading of "CCleanerReactivator.dll"
Detects potential DLL sideloading using comctl32.dll to obtain system privileges
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Detects DLL sideloading of "dbgcore.dll"
Page 107 of 680