SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,477 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference
Detects when a user downloads a file by using CertOC.exe
Detects possible payload obfuscation via the commandline
Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
Detects usage of the "type" command to download/upload data from WebDAV server
detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Well-known DNS Exfiltration tools execution
Attackers may leverage fsutil to enumerated connected drives.
Page 647 of 680