SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,502 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
The Devtoolslauncher.exe executes other binary
Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
Extract data from cab file and hide it in an alternate data stream
Gpscript Execution
Sigma
Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy
Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution
MpiExec Lolbin
Sigma
Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
The OpenWith.exe executes other binary
Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability
Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.
Page 128 of 680