SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,528 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges
Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs
Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool)
Procdump Execution
Sigma
Detects usage of the SysInternals Procdump utility
Identifies when a owner is was removed from a application or service principal in Azure.
Detects potential tampering with Windows Defender settings such as adding exclusion using wmic
Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes.
Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.
Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.
Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.
Page 20 of 680