SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,529 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects usage of bitsadmin downloading a file from a suspicious domain
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe
Detects the attempt to create a process via "wmic" with the "process call create" flag, which might
indicate an attempt to execute a malicious process on the compromised host. Adversaries may use
wmic to execute a process on the compromised host as part of their attack. This event is triggered on
on attempt and process creation can be either successful or unsuccessful.
indicate an attempt to execute a malicious process on the compromised host. Adversaries may use
wmic to execute a process on the compromised host as part of their attack. This event is triggered on
on attempt and process creation can be either successful or unsuccessful.
Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts
Detects the execution of WMIC in order to get a list of firewall and antivirus products
An adversary might use WMI to check if a certain remote service is running on a remote device.
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable
Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts
Detects the removal or uninstallation of an application via "Wmic.EXE".
Detects the download of suspicious file type from a well-known file and paste sharing domain
Page 22 of 680