SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,530 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects BITS transfer job downloading files from a file sharing domain.
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.
Detects potentially suspicious file download from file sharing domains using curl.exe
Detects potentially suspicious file downloads from file sharing domains using wget.exe
Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles
Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance
and will execute registered JScript or VBScript code as a result.
Script event consumers are a built-in Windows Management Instrumentation (WMI) class that
automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.
Adversaries often abuse script event consumers to maintain persistence on a compromised host
by executing a malicious script whenever a specific event occurs.
and will execute registered JScript or VBScript code as a result.
Script event consumers are a built-in Windows Management Instrumentation (WMI) class that
automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.
Adversaries often abuse script event consumers to maintain persistence on a compromised host
by executing a malicious script whenever a specific event occurs.
Page 24 of 680