SigmaHQ | Detection.FYI

sigma

Oct 9, 2025 ·
Share on:

Read More

Recent Posts

Alternate PowerShell Hosts Pipe
Amsi.DLL Loaded Via LOLBIN Process
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
Browser Execution In Headless Mode
Change PowerShell Policies to an Insecure Level
CurrentVersion Autorun Keys Modification
CurrentVersion NT Autorun Keys Modification
Delete Defender Scan ShellEx Context Menu Registry Key

Language

SIGMA 3939 ELASTIC 1495 MQL 732

Tags

RESOURCES-INVESTIGATION-GUIDE 1421 ATTACK.DEFENSE-EVASION 1320 USE-CASE-THREAT-DETECTION 1058 DOMAIN-ENDPOINT 919 ATTACK.EXECUTION 870 DATA-SOURCE-ELASTIC-DEFEND 752 ATTACK.PERSISTENCE 592 OS-WINDOWS 496 DATA-SOURCE-ELASTIC-ENDGAME 431 DETECTION.EMERGING-THREATS 398 ATTACK.PRIVILEGE-ESCALATION 390 TACTIC-DEFENSE-EVASION 383 OS-LINUX 382 DATA-SOURCE-SENTINELONE 370