SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,738 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of "AccCheckConsole.exe" with command-line arguments indicative of its use for UI accessibility checking, which can be abused to load malicious DLLs. This utility allows providing a custom DLL containing a "verification routine" via the command line, enabling an attacker to inject and execute arbitrary code within the context of the legitimate `AccCheckConsole` process.
Detects the execution of 'Advanced Port Scanner' based on its image name, original file name, description, or specific command-line arguments. This tool is often used for network reconnaissance.
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities. This rule specifically looks for `schtasks.exe` being used with the `/Change`, `/TN`, and `/disable` arguments, targeting important system tasks like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate.
Detects a network connection initiated by programs or processes running from suspicious or uncommon file system locations. This often indicates malware execution or persistence from areas not typically used by legitimate applications for network communication.
Detects file being transferred via ScreenConnect RMM
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
Detects command execution via ScreenConnect RMM
Detects the creation of files in a specific location by ScreenConnect RMM.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature
Page 403 of 680