SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,618 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of the "jsc.exe" (JScript Compiler).
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
Detects execution of the Windows Kernel Debugger "kd.exe".
Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.
Detects an uncommon parent process of "LINK.EXE".
Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.
Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.
The Devtoolslauncher.exe executes other binary
Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
Extract data from cab file and hide it in an alternate data stream
Gpscript Execution
Sigma
Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy
Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution
Page 125 of 680