SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,525 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious process patterns used in NTDS.DIT exfiltration
Shadow Copies creation using operating systems utilities, possible credential access
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detects suspicious addition to BitLocker related registry keys via the reg.exe utility
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads
Page 678 of 680