SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,615 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules.
Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension.
Initial baselining of the allowed extension list is required.
Initial baselining of the allowed extension list is required.
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.
Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse
Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code.
Attackers might abuse this in order to bypass application whitelisting.
Attackers might abuse this in order to bypass application whitelisting.
Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.
Detects commandline arguments for executing a child process via dotnet-trace.exe
Detects usage of Dsacls to grant over permissive permissions
Page 119 of 680