SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,565 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.
Detects REGSVR32.exe to execute DLL hosted on remote shares
Detects potentially suspicious child processes of "regsvr32.exe".
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.
Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Detects execution of renamed version of PAExec. Often used by attackers
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Detects renamed vmnat.exe or portable version that can be used for DLL side-loading
Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452
Page 69 of 680