SigmaHQ Detections
@sigmaHQ12 followers122,467 downloads2,593 copies16 likes160,481 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects any assembly DLL being loaded by an Office Product
Detects CLR DLL being loaded by an Office Product
Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location
Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process
Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Attackers can abuse the utility in order to download malware or additional payloads.
Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"
Page 640 of 680