SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,540 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of a named pipe as used by CobaltStrike
Detects the creation of a named pipe seen used by known APTs or malware.
Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation
Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.
Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands.
Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.
This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.
Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools.
This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.
Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
Detects execution of Chromium based browser in headless mode
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Detects the use of powershell commands from headless ConHost window.
The "--headless" flag hides the windows from the user upon execution.
The "--headless" flag hides the windows from the user upon execution.
Page 47 of 680