SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,619 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.
Detects the execution of a renamed Microsoft Teams binary.
Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Detects the execution of a renamed office binary
Detects the execution of a renamed version of the Plink binary
Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries
Detects execution of renamed Remote Utilities (RURAT) via Product PE header field
Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).
Detects execution of "rundll32" calling "advpack.dll" with potential obfuscated ordinal calls in order to leverage the "RegisterOCX" function
Page 136 of 680