SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Detects execution of renamed version of PAExec. Often used by attackers
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Detects renamed vmnat.exe or portable version that can be used for DLL side-loading
Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452
Detects suspicious process run from unusual locations
Detects shell32.dll executing a DLL in a suspicious directory
Detects the execution of Rundll32.exe with DLL files masquerading as image files
ShimCache Flush
Sigma
Detects actions that clear the local ShimCache and remove forensic evidence
Page 76 of 680