SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,619 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag
Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"
Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.
Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.
VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution.
Detects modification of LSA PPL protection settings via CommandLine.
It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.
It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.
Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.
Page 127 of 680