SigmaHQ Detections
@sigmaHQ12 followers122,468 downloads2,593 copies16 likes160,483 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects modification of LSA PPL protection settings via CommandLine.
It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.
It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.
Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files
Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files
Adversaries may modify system firewalls in order to bypass controls limiting network usage
Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line
Detects requests to disable Microsoft Defender features using PowerShell commands
Detects attackers attempting to disable Windows Defender using Powershell
Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.
Detects Python one-liners that use base64 decoding functions in command line executions.
Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Page 56 of 680