SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,499 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Suspicious GUP Usage
Sigma
Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks
HH.EXE Execution
Sigma
Detects the execution of "hh.exe" to open ".chm" files.
Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.
Detects the use of CoercedPotato, a tool for privilege escalation
Detects suspicious command lines used in Covenant luanchers
The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.
Detects some Empire PowerShell UAC bypass methods
Detects the execution GMER tool based on image and hash fields.
Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Page 124 of 680