SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context
Detects the creation of binaries in the WinSxS folder by non-system processes
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
Detects processes loading modules related to PCRE.NET package
Detects any GAC DLL being loaded by an Office Product
Detects a remote DLL load event via "rundll32.exe".
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Page 612 of 680