SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection
Detect suspicious parent processes of well-known Windows processes
Detects process execution from a fake recycle bin folder, often used to avoid security solution.
Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence.
Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.
Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.
Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence.
This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.
This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.
Detects a service binary running in a suspicious directory
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger.
This option may be used adversaries to execute malicious code by signed verified binary.
The debugger is installed alongside with Microsoft Visual Studio package.
This option may be used adversaries to execute malicious code by signed verified binary.
The debugger is installed alongside with Microsoft Visual Studio package.
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.
Detects using WorkFolders.exe to execute an arbitrary control.exe
Page 144 of 680