SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the `mknod` syscall to create special files (e.g., character or block devices) on Linux systems. This syscall is rarely used by legitimate applications and can be abused by attackers or malware to create fake devices, interact with kernel interfaces, establish covert channels, bypass file system restrictions, or create backdoors.
This rule detects the installation of a new service that exhibits characteristics commonly associated with the Meterpreter or Cobalt Strike 'getsystem' command. Specifically, it looks for Event ID 4697 (A service was installed in the system) and then analyzes the 'ServiceFileName' for patterns indicative of these tools. It identifies two main techniques: one involving 'cmd.exe' or '%COMSPEC%' echoing data to a named pipe (e.g., `echo 559891bb017 > \\.\pipe\5e120a`), and another involving 'rundll32.exe' loading a DLL with specific arguments (e.g., `rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn`). Additionally, it flags service installations where the 'ServiceFileName' starts with a specific network share path (`\\127.0.0.1\ADMIN$\`). These methods are typically used by adversaries to escalate privileges to SYSTEM.
Detects the loading of the WinDivert driver, which is a powerful user-mode package for Windows capable of capturing, sniffing, modifying, blocking, and re-injecting network traffic. This driver can be used by adversaries for network sniffing, credential access, and defense evasion techniques.
Detects attempts to create a DLL file in known desktop application dependencies folders (e.g., Slack, Teams, OneDrive) by an unusual process. This activity may indicate an adversary attempting to load a malicious module via DLL search order hijacking for persistence, privilege escalation, or defense evasion.
Detects the creation of a macro file for Outlook, specifically 'VbaProject.OTM', which can be used for persistence or to execute malicious code when Outlook is launched.
Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.
Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
Detects specific registry markers associated with the FlowCloud malware, which is known to be used by the threat group TA410. The rule identifies unique registry paths where FlowCloud stores its configuration and drivers for its keylogger components.
Detects the use of the Pingback backdoor, which establishes an ICMP tunnel for command and control (C2) communications. The rule specifically looks for the creation of a process where the parent image ends with 'updata.exe' and the command line contains 'config', 'msdtc', 'start', and 'auto'. This combination of parent process and command-line arguments is indicative of the Pingback backdoor's activity as described in the Trustwave report.
Detects the execution of concatenated commands via "cmd.exe" that are characteristic of Pikabot malware. Pikabot often uses "cmd /c" to combine commands like "curl" or "wget" for downloading payloads, "ping" and "timeout" for delays, and "Rundll32" for executing malicious DLLs. The rule specifically looks for the combination of these commands, indicating potential Pikabot infection.
Page 204 of 680