Sponsor of the Day:
Jerkmate
https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_hktl_hydra/
HackTool - Hydra Password Bruteforce Execution | Detection.FYI
Detects command line parameters used by Hydra password guessing hack tool
execution detection fyihacktoolhydrapasswordbruteforce
https://detection.fyi/sigmahq/sigma/windows/file/file_event/file_event_win_hktl_dumpert/
HackTool - Dumpert Process Dumper Default File | Detection.FYI
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
default filedetection fyihacktoolprocessdumper
https://detection.fyi/sigmahq/sigma/windows/file/file_event/file_event_win_hktl_safetykatz/
HackTool - SafetyKatz Dump Indicator | Detection.FYI
Detects default lsass dump filename generated by SafetyKatz.
detection fyihacktooldumpindicator
https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_hktl_certipy/
HackTool - Certipy Execution | Detection.FYI
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line …
execution detection fyihacktool
https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern/
HackTool - Sliver C2 Implant Activity Pattern | Detection.FYI
Detects process activity patterns as seen being used by Sliver C2 framework implants
pattern detection fyihacktoolsliverc2implant
https://sploitus.com/
💀 Sploitus | Exploit & Hacktool Search Engine
Sploitus is a convenient central place for identifying the newest exploits and finding attacks that exploit known vulnerabilities. The search engine is also a...
search engineexploithacktool
https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_hktl_hollowreaper/
HackTool - HollowReaper Execution | Detection.FYI
Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a...
execution detection fyihacktool
https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_hktl_sharp_chisel/
HackTool - SharpChisel Execution | Detection.FYI
Detects usage of the Sharp Chisel via the commandline arguments
execution detection fyihacktool
https://detection.fyi/sigmahq/sigma/windows/image_load/image_load_hktl_sharpevtmute/
HackTool - SharpEvtMute DLL Load | Detection.FYI
Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs
dll loaddetection fyihacktool
https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch/
HackTool - Empire PowerShell Launch Parameters | Detection.FYI
Detects suspicious powershell command line parameters used in Empire
detection fyihacktoolempirepowershelllaunch