SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of named pipes by alternate PowerShell hosts, which might be used to bypass detections specifically looking for `powershell.exe`. This rule identifies processes that create named pipes starting with '\PSHost' but are not the standard PowerShell executables or other common legitimate processes that might use such pipes.
Detects suspicious copy operations where a program is copied from a system directory (System32, SysWOW64, WinSxS) to another location on disk. This technique is often used by adversaries to move Living Off The Land Binaries (LOLBINs) like 'certutil' or 'desktopimgdownldr' to a different directory or rename them to bypass detections based on their original location or name.
Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows. This registry modification can be used by adversaries for defense evasion, potentially to suppress pop-ups that might alert a user to unusual browser behavior or to streamline the execution of malicious activities without user interaction.
Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG".
JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
This rule detects attempts to unload filter drivers using the 'fltmc.exe' utility. Adversaries may unload filter drivers, which are often used by security products (like EDRs or antivirus), to impair defenses and evade detection. The rule specifically looks for 'fltmc.exe' being executed with the 'unload' command-line argument. It includes filters for known legitimate activities from Avira and ManageEngine to reduce false positives.
Detects the usage of msiexec.exe to perform a quiet installation of a package from a remote location (either HTTP/HTTPS or a UNC path). This behavior is often associated with malware distribution, including the Raspberry Robin worm, to evade detection and establish persistence.
Detects the usage of the "Squirrel.exe" or "Update.exe" binaries to execute arbitrary processes, often seen with Electron-based applications like Slack, Teams, and Discord. This technique can be abused by adversaries for defense evasion and execution.
This rule detects the creation of processes where the command line or image path explicitly references the 'Sysnative' folder (e.g., 'C:\Windows\Sysnative\'). This behavior is often observed in malware, particularly Cobalt Strike, to bypass WoW64 file system redirection and execute 64-bit binaries from a 32-bit process. The rule includes filters to reduce false positives from legitimate applications like .NET's ngen.exe and XAMPP's use of cmd.exe within Sysnative.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Detects when a mounted network share is removed using PowerShell cmdlets such as 'Remove-SmbShare' or 'Remove-FileShare'. This activity can be an indicator of an adversary cleaning up traces of their operations.
Page 271 of 680