SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,517 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
Detects the execution of CoercedPotato, a tool used for privilege escalation. The rule specifically looks for the executable name 'CoercedPotato.exe', the command-line argument '--exploitId', or specific import hashes (IMPHASH) associated with the tool. This tool leverages vulnerabilities to achieve higher privileges on a system.
Detects suspicious calls to the "ShellExec_RunDLL" exported function of SHELL32.DLL using an ordinal number to launch other commands. Adversaries might use ordinal numbers to bypass detections that rely on the function name in the command line. The rule looks for specific ordinal numbers associated with ShellExec_RunDLL and combines this with suspicious parent command-line arguments (e.g., containing 'comspec', 'iex', 'Invoke-', or paths like 'Temp') or suspicious child processes (e.g., bash, cmd, powershell, bitsadmin, msiexec).
Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer.
LaZagne has been leveraged multiple times by threat actors in order to dump credentials.
LaZagne has been leveraged multiple times by threat actors in order to dump credentials.
Detects Windows executables that write files with suspicious extensions
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code
Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Detects creation of a new service (kernel driver) with the type "kernel"
Page 276 of 680