SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,565 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects creation of local users via the net.exe command with the option "never expire"
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
Nltest.EXE Execution
Sigma
Detects nltest commands that can be used for information discovery
Detects nltest commands that can be used for information discovery
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Detects a suspicious program execution in Outlook temp folder
Detects suspicious Plink tunnel port forwarding to a local port
Detects usage of a base64 encoded "IEX" cmdlet in a process command line
Detects the creation of a new service using powershell.
Detects usage of the 'Get-Clipboard' cmdlet via CLI
Page 619 of 680