SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,474 copies16 likes159,599 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of the LiveKD driver by a process image other than "livekd.exe".
Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"
Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)
Detects the pattern of a UAC bypass using Windows Event Viewer
Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique
Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
Page 101 of 680