SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,612 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detect use of X509Enrollment
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
Detects the process injection of a LittleCorporal generated Maldoc.
Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
Detects when a process tries to access the memory of svchost to potentially dump credentials.
Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.
Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.
Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.
Page 113 of 680