SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.
Detects the execution of a renamed Microsoft Teams binary.
Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Detects the execution of a renamed office binary
Detects the execution of a renamed version of the Plink binary
Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries
Detects execution of renamed Remote Utilities (RURAT) via Product PE header field
Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).
An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver
Page 138 of 680