SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,614 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Detects potentially suspicious child processes of "GoogleUpdate.exe"
Suspicious GUP Usage
Sigma
Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks
HH.EXE Execution
Sigma
Detects the execution of "hh.exe" to open ".chm" files.
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.
Detects the use of CoercedPotato, a tool for privilege escalation
Detects suspicious command lines used in Covenant luanchers
The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.
Page 121 of 680