SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,570 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.
Detects default CSExec service filename which indicates CSExec service installation and execution
Detects suspicious file type dropped by an Exchange component in IIS
Detects files written by the different tools that exploit HiveNightmare
Detects a dump file written by QuarksPwDump password dumper
Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs".
Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.
Detects the creation of a new Outlook form which can contain malicious code
Detects processes creating temp files related to PCRE.NET package
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Page 613 of 680