SigmaHQ Detections
@sigmaHQ12 followers122,468 downloads2,593 copies16 likes160,483 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects possible Sysmon filter driver unloaded via fltmc.exe
Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files
Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
Detects the execution of "logman" utility in order to disable or delete Windows trace sessions
Detect indirect command execution via Program Compatibility Assistant pcwrun.exe
Detects potential DLL injection and execution using "Tracker.exe"
Use of TTDInject.exe
Sigma
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
Page 55 of 680