SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
load malicious registered COM objects
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie".
This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
Detects dump of credentials in VeeamBackup dbo
Detects encoded base64 MZ header in the commandline
WhoAmI as Parameter
Sigma
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
Detects usage of the "systeminfo" command to retrieve information
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
Page 619 of 680