SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument
Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
Detects MsiExec loading a DLL and calling its DllUnregisterServer function
Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Files with well-known filenames (sensitive files with credential data) copying
Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool
Page 8 of 680