SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,606 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a network connection initiated by "wordpad.exe" over uncommon destination ports.
This might indicate potential process injection activity from a beacon or similar mechanisms.
This might indicate potential process injection activity from a beacon or similar mechanisms.
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.
Detects the pattern of a pipe name as used by the hack tool EfsPotato
Detects creation of default named pipes used by the Koh tool
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Detects PowerShell called from an executable by the version mismatch method
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.
Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.
Detects keywords that could indicate clearing PowerShell history
A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.
Page 108 of 680