SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,571 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context
Detects the creation of binaries in the WinSxS folder by non-system processes
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
Detects processes loading modules related to PCRE.NET package
Detects any GAC DLL being loaded by an Office Product
Detects a remote DLL load event via "rundll32.exe".
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Page 614 of 680