SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,545 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild
Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser.
An attacker can use this to authenticate to Azure AD in a browser as that user.
An attacker can use this to authenticate to Azure AD in a browser as that user.
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software
Detects potential DLL sideloading of "DbgModel.dll"
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe
Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location
Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor
Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager
Page 61 of 680