SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious addition to BitLocker related registry keys via the reg.exe utility
Detects suspicious parent processes that should not have any children or should only have a single possible child program
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%
Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads
Detects PowerShell script execution from Alternate Data Stream (ADS)
Detects suspicious PowerShell invocation with a parameter substring
Adversaries may log user keystrokes to intercept credentials as the user types them.
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
Attackers can use print.exe for remote file copy
Page 678 of 680