SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects suspicious process patterns found in logs when CrackMapExec is used
Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)
Detects suspicious use of XORDump process memory dumping utility
Detects execution of javascript code using "mshta.exe".
Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file
Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution
Detects command line parameters used by Bloodhound and Sharphound hack tools
Page 671 of 680