SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,541 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files
Adversaries may modify system firewalls in order to bypass controls limiting network usage
Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line
Detects requests to disable Microsoft Defender features using PowerShell commands
Detects attackers attempting to disable Windows Defender using Powershell
Detects the execution of a specific OneLiner to download and execute powershell modules in memory.
Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.
Page 49 of 680