SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,517 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components. This rule specifically looks for `conhost.exe` spawning `cmd.exe`, `cscript.exe`, `mshta.exe`, `powershell_ise.exe`, `powershell.exe`, `pwsh.exe`, `regsvr32.exe`, or `wscript.exe`.
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string and performs GET requests. This activity is indicative of reconnaissance or data scraping.
This rule detects suspicious filenames that leverage the right-to-left override (RTLO) Unicode character (U+202E) in conjunction with a spoofed file extension. Adversaries use RTLO to visually reverse parts of a filename, making a malicious executable appear as a benign file type (e.g., 'evil.exe' appearing as 'evil.txt.exe' or 'document.pdf' appearing as 'document.exe'). The rule specifically looks for the RTLO character and a list of common file extensions that have been reversed (e.g., '3pm.' for '.mp3', 'cod.' for '.doc'). This technique is often used in phishing attacks to trick users into executing malicious files.
This rule detects the execution of `mmc.exe` with command-line arguments that indicate the use of Right-to-Left Override (RTLO) characters to disguise file extensions. Specifically, it looks for `.msc` files that, due to RTLO abuse, appear to be common document types like `.pdf`, `.doc`, `.xlsx`, etc., but are actually `.msc` files. This technique is often used by adversaries for defense evasion and to trick users into executing malicious files.
Detects when the Microsoft Management Console (MMC) loads scripting engine DLLs such as vbscript.dll, jscript.dll, or jscript9.dll. This activity can indicate an attempt to execute malicious scripts within a trusted system process, potentially for bypassing application whitelisting or defense evasion.
Detects the presence of the "u202+E" character in command lines, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This technique is used for obfuscation and masquerading to make malicious files appear benign.
Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.
Detects the use of PowerShell cmdlets (`Get-LocalGroup`, `Get-LocalGroupMember`) or WMI queries (`Get-WmiObject`, `Get-CimInstance` targeting `Win32_Group`) to gather local group information. Adversaries commonly use these methods to discover local system permission groups and identify users with elevated privileges, such as local administrators.
Detects the removal of a port or application rule in the Windows Firewall configuration using netsh
Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Page 275 of 680