SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Shadow Copies creation using operating systems utilities, possible credential access
Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance
and will execute registered JScript or VBScript code as a result.
Script event consumers are a built-in Windows Management Instrumentation (WMI) class that
automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.
Adversaries often abuse script event consumers to maintain persistence on a compromised host
by executing a malicious script whenever a specific event occurs.
and will execute registered JScript or VBScript code as a result.
Script event consumers are a built-in Windows Management Instrumentation (WMI) class that
automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.
Adversaries often abuse script event consumers to maintain persistence on a compromised host
by executing a malicious script whenever a specific event occurs.
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Detects suspicious DNS queries known from Cobalt Strike beacons
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection
Detects the attack technique pass the hash which is used to move laterally inside the network
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Page 677 of 680