SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,727 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects creation of a scheduled task with a GUID like name
Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks.
In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader
Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type
Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.
Detects abusing Windows 10 Narrator's Feedback-Hub
DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll
Page 268 of 680