SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,502 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects PowerShell script execution via input stream redirect
Detects PowerShell execution to set the ACL of a file or a folder
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Detect use of X509Enrollment
Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files
Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL
Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.
Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)
Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.
Page 134 of 680