LOLBAS

AppInstaller.yml

…

Aspnet_Compiler.yml

…

At.yml

Remove unnecessary "at" on command (#286 )

2023-05-01 23:36:38 +01:00

Atbroker.yml

…

Bash.yml

…

Bitsadmin.yml

…

Certoc.yml

…

Certreq.yml

Removing pre-Windows 10 OSs from CertReq entry, fixes #247

2023-02-25 19:19:22 +00:00

Certutil.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Cmd.yml

Adding WebDav techniques to cmd.exe entry (#273 )

2023-03-08 14:39:32 +00:00

Cmdkey.yml

…

Cmdl32.yml

Update Cmdl32.exe resource links (#317 )

2023-08-04 11:21:36 +01:00

Cmstp.yml

…

Colorcpl.yml

Added colorcpl.exe (#315 )

2023-07-27 18:18:49 +01:00

ConfigSecurityPolicy.yml

…

Conhost.yml

Add vsls-agent lolbin and committing a few other changes (#263 )

2023-02-25 18:47:44 +00:00

Control.yml

…

Csc.yml

…

Cscript.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

CustomShellHost.yml

Add Sigma rule references to various LOLBAS (#260 )

2022-10-26 09:10:39 +01:00

DataSvcUtil.yml

…

Desktopimgdownldr.yml

…

DeviceCredentialDeployment.yml

Add Sigma rule references to various LOLBAS (#260 )

2022-10-26 09:10:39 +01:00

Dfsvc.yml

…

Diantz.yml

…

Diskshadow.yml

…

Dnscmd.yml

…

Esentutl.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Eventvwr.yml

Add vsls-agent lolbin and committing a few other changes (#263 )

2023-02-25 18:47:44 +00:00

Expand.yml

…

Explorer.yml

Several LOLBINs additions & modifications (#192 )

2023-03-31 13:46:21 +01:00

Extexport.yml

…

Extrac32.yml

…

Findstr.yml

…

Finger.yml

…

FltMC.yml

…

Forfiles.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

fsutil.yml

Add Sigma rule references to various LOLBAS (#260 )

2022-10-26 09:10:39 +01:00

Ftp.yml

…

Gpscript.yml

…

Hh.yml

…

Ie4uinit.yml

…

Ieexec.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Ilasm.yml

…

IMEWDBLD.yml

…

Infdefaultinstall.yml

…

Installutil.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Jsc.yml

…

Ldifde.yml

Add sigma and remove ampty string (#297 )

2023-06-17 20:30:00 +01:00

Makecab.yml

…

Mavinject.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Microsoft.Workflow.Compiler.yml

…

Mmc.yml

…

MpCmdRun.yml

…

Msbuild.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Msconfig.yml

…

Msdt.yml

Adding and updating various LOLBINS (#229 )

2022-11-11 16:42:44 +00:00

msedge_proxy.yml

Update msedge_proxy.yml

2023-09-05 18:47:05 +03:00

Msedge.yml

Merge pull request #295 from frack113/sigma_20230610

2023-06-11 22:10:04 -04:00

msedgewebview2.yml

Create msedgewebview2.exe (#299 )

2023-06-17 21:56:16 +01:00

Mshta.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Msiexec.yml

…

Netsh.yml

…

Odbcconf.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

OfflineScannerShell.yml

…

OneDriveStandaloneUpdater.yml

Add Sigma rule references to various LOLBAS (#260 )

2022-10-26 09:10:39 +01:00

Pcalua.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Pcwrun.yml

Adding and updating various LOLBINS (#229 )

2022-11-11 16:42:44 +00:00

Pktmon.yml

…

Pnputil.yml

…

Presentationhost.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Print.yml

…

PrintBrm.yml

…

Provlaunch.yml

Add SigmaHQ ref

2023-09-03 15:06:34 +02:00

Psr.yml

…

Rasautou.yml

…

Rdrleakdiag.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Reg.yml

…

Regasm.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Regedit.yml

…

Regini.yml

…

Register-cimprovider.yml

…

Regsvcs.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Regsvr32.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Replace.yml

…

Rpcping.yml

…

Rundll32.yml

…

Runexehelper.yml

Add sigma ref Detection (#272 )

2022-12-29 09:51:15 -05:00

Runonce.yml

…

Runscripthelper.yml

…

Sc.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Schtasks.yml

…

Scriptrunner.yml

…

Setres.yml

Add sigma ref Detection (#272 )

2022-12-29 09:51:15 -05:00

SettingSyncHost.yml

…

Ssh.yml

Add missing document starts and add yamllint rule (#305 )

2023-06-23 20:55:39 +01:00

Stordiag.yml

…

Syncappvpublishingserver.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Tar.yml

Tar.exe lateral movement (#277 )

2023-06-17 22:25:34 +01:00

Teams.yml

Added Sigma to Teams.exe (#329 )

2023-10-03 12:04:39 +01:00

Ttdinject.yml

…

Tttracer.yml

…

Unregmp2.yml

Add sigma ref Detection (#272 )

2022-12-29 09:51:15 -05:00

Vbc.yml

…

Verclsid.yml

…

Wab.yml

…

Winget.yml

…

Wlrmdr.yml

…

Wmic.yml

…

WorkFolders.yml

…

Wscript.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Wsreset.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

wt.yml

Adding and updating various LOLBINS (#229 )

2022-11-11 16:42:44 +00:00

Wuauclt.yml

…

Xwizard.yml

…