SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,620 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects PowerShell script execution via input stream redirect
Detects PowerShell execution to set the ACL of a file or a folder
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Detect use of X509Enrollment
Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files
Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL
Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.
Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)
Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.
Page 132 of 680