SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,560 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a potentially suspicious execution from an uncommon folder.
Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll.
This detection assumes that PowerShell commands are passed via the CommandLine.
This detection assumes that PowerShell commands are passed via the CommandLine.
Shadow Copies deletion using operating systems utilities
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Detects a suspicious child process of userinit
Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC
Detects the pattern of UAC Bypass using Event Viewer RecentViews
Detects indicators of a UAC bypass method by mocking directories
Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.
UAC Bypass WSReset
Sigma
Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config
Page 71 of 680