SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)
Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script
Detects when a user disables the Windows Firewall via a Profile to help evade defense.
Detect use of X509Enrollment
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
Detects the process injection of a LittleCorporal generated Maldoc.
Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
Detects when a process tries to access the memory of svchost to potentially dump credentials.
Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.
Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)
Page 116 of 680