SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,571 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
Detects NetSupport Manager service installation on the target system.
Detects PAExec service installation
Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour
Detects blocking of process creations originating from PSExec and WMI commands
Detects triggering of AMSI by Windows Defender.
Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL
Detects DNS server discovery via LDAP query requests from uncommon applications
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Page 612 of 680