SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,526 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.
Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
Detects Windows shells and scripting applications that write files to suspicious folders
Detects new BITS transfer job saving local files with potential suspicious extensions
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)
Shadow Copies storage symbolic link creation using operating systems utilities
Adversaries may search for private key certificate files on compromised systems for insecurely stored credential
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Page 672 of 680