SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,612 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system.
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.
Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution
Detects the execution of certutil with certain flags that allow the utility to download files.
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.
Detects possible NTLM coercion via certutil using the 'syncwithWU' flag
Page 116 of 680