SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,623 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a service binary running in a suspicious directory
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
Tasks Folder Evasion
Sigma
The Tasks folder in system32 and syswow64 are globally writable paths.
Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application
in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr
Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application
in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr
Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces
Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe
Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe
There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger.
This option may be used adversaries to execute malicious code by signed verified binary.
The debugger is installed alongside with Microsoft Visual Studio package.
This option may be used adversaries to execute malicious code by signed verified binary.
The debugger is installed alongside with Microsoft Visual Studio package.
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.
Detects using WorkFolders.exe to execute an arbitrary control.exe
Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location.
Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
Detects execution of LiveKD based on PE metadata or image name
Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory
Page 143 of 680