SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,476 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Detects installation of a new shim using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.
Detects suspicious parent process for cmd.exe
Detects usage of winget to add new potentially suspicious download sources
Detects default RemCom pipe creation
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.
Detects suspicious changes to the Windows Defender configuration
Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.
Page 663 of 680