SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,551 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
load malicious registered COM objects
Detects dump of credentials in VeeamBackup dbo
Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)
Detects encoded base64 MZ header in the commandline
WhoAmI as Parameter
Sigma
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Detects usage of the "systeminfo" command to retrieve information
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
Detects a suspicious RDP session redirect using tscon.exe
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
When configured with suitable command line arguments, w32tm can act as a delay mechanism
Page 621 of 680