SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,551 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Use of Wfc.exe
Sigma
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
Detects a CodePage modification using the "mode.com" utility to Russian language.
This behavior has been used by threat actors behind Dharma ransomware.
This behavior has been used by threat actors behind Dharma ransomware.
Msxsl.EXE Execution
Sigma
Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files.
Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.
Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule
Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.
Page 66 of 680