SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,474 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.
Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.
Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
Detects Windows shells and scripting applications that write files to suspicious folders
Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline
Detects new BITS transfer job saving local files with potential suspicious extensions
Page 668 of 680