SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,499 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting
Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files
Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Detects the use of SharpUp, a tool for local privilege escalation
Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.
This behavior has been observed in-the-wild by different threat actors.
This behavior has been observed in-the-wild by different threat actors.
Page 126 of 680