SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,524 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)
Uses the .NET InstallUtil.exe application in order to execute image without log
MsiExec Web Install
Sigma
Detects suspicious msiexec process starts with web addresses as parameter
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Interactive AT Job
Sigma
Detects an interactive AT job, which may be used as a form of privilege escalation.
A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.
Detects creation of WMI event subscription persistence method
Page 680 of 680