SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a network connection that is initiated by the "notepad.exe" process.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
Detects a rundll32 that communicates with public IP addresses
Detects a possible remote connections to Silenttrinity c2
Detects suspicious network connections made by a well-known Windows binary run with no command line parameters
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects a network connection initiated by "wordpad.exe" over uncommon destination ports.
This might indicate potential process injection activity from a beacon or similar mechanisms.
This might indicate potential process injection activity from a beacon or similar mechanisms.
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.
Detects the pattern of a pipe name as used by the hack tool EfsPotato
Detects creation of default named pipes used by the Koh tool
Page 111 of 680