SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.
F-Secure C3 produces DLLs with a default exported StartNodeRelay function.
Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script
Detects potentially suspicious child processes of KeyScrambler.exe
Detects file execution using the msdeploy.exe lolbin
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting
Detects using SettingSyncHost.exe to run hijacked binary
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
Use of Wfc.exe
Sigma
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Page 72 of 680