SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,541 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files
Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
Detects the execution of "logman" utility in order to disable or delete Windows trace sessions
Detect indirect command execution via Program Compatibility Assistant pcwrun.exe
Detects potential DLL injection and execution using "Tracker.exe"
Use of TTDInject.exe
Sigma
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Page 48 of 680