SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,618 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
MpiExec Lolbin
Sigma
Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
The OpenWith.exe executes other binary
Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability
Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.
Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.
Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs
Detects execution of powershell scripts via Runscripthelper.exe
Detects using SettingSyncHost.exe to run hijacked binary
Page 126 of 680