SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,581 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
Detects network connections from the Equation Editor process "eqnedt32.exe".
Detects well-known credential dumping tools execution via specific named pipe creation
Detects PAExec default named pipe
Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell
PowerShell PSAttack
Sigma
Detects the use of PSAttack PowerShell hack tool
Detects usage of Gpg4win to decrypt files
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397
Page 602 of 680