SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,501 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.
Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.
Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs
Detects execution of powershell scripts via Runscripthelper.exe
Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag
Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.
Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"
Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.
Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.
Page 129 of 680