SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,622 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry
Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection
Detects suspicious parent processes that should not have any children or should only have a single possible child program
Detect suspicious parent processes of well-known Windows processes
Detects process execution from a fake recycle bin folder, often used to avoid security solution.
Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence.
Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.
Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.
Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence.
This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.
This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.
Page 142 of 680