SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,551 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack
Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.
F-Secure C3 produces DLLs with a default exported StartNodeRelay function.
Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script
Detects potentially suspicious child processes of KeyScrambler.exe
Detects file execution using the msdeploy.exe lolbin
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Use of Remote.exe
Sigma
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.
The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
Page 65 of 680