SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,518 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of Windows Defender Application Control (WDAC) policy files (.cip or .p7b) within the `C:\Windows\System32\CodeIntegrity\` folder by a process running with 'High' integrity. Attackers can leverage this technique to deploy custom WDAC policies that block Endpoint Detection and Response (EDR) components, effectively bypassing security measures and enabling undetected malicious activity after a system reboot.
Detects the download of suspicious file types (executables, DLLs, scripts, etc.) from well-known file and paste sharing domains. The detection specifically looks for the creation of Alternate Data Streams (ADS) with a ':Zone' identifier, which indicates the file was downloaded from the internet and carries Mark-of-the-Web.
This rule detects the execution of Visual Studio Code (VS Code) tunnel functionality, particularly when the executable has been renamed. Attackers can abuse this feature to establish a command and control (C2) channel, bypassing typical network restrictions. The rule looks for command-line arguments indicative of VS Code tunnel activation, including specific arguments for accepting license terms or running as a service, and also checks for `cmd.exe` spawning the tunnel process.
Detects potential PsExec command execution on remote systems by looking for common command-line flags used by the utility, specifically 'accepteula', user credentials (' -u ', ' -p '), and a remote path (' \\'). It filters out connections to localhost.
Detects the use of curl.exe to download files from known file-sharing or code-hosting domains. This activity is often associated with adversaries staging or retrieving malicious tools and scripts. The rule specifically looks for curl.exe executing with command-line arguments indicating a download operation ('-O', '--remote-name', '--output') from a list of suspicious domains, and targeting common executable or script file extensions.
Detects the creation of new DLL files within the Notepad++ plugins directory by any process other than 'gup.exe' or the main installer. This activity could indicate an attempt to establish persistence on the system by injecting malicious plugins into Notepad++.
Detects BITS transfer jobs downloading files from known file-sharing or code-hosting domains often abused by adversaries for staging or delivering malicious payloads. This rule specifically looks for EventID 16403 in the BITS client logs, indicating a file transfer, and checks if the remote source domain matches a list of suspicious domains.
Detects suspicious new RUN key element pointing to an executable in a suspicious folder
Detects DNS queries to domains within known low reputation Effective Top-Level Domains (eTLDs). These eTLDs are often associated with malicious activities such as command and control, phishing, or malware distribution. The rule leverages a curated list of suspicious eTLDs, which is updated periodically.
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the `RunMRU` registry key. This technique is often abused by threat actors to trick users into pasting and executing malicious commands, sometimes disguised as CAPTCHA verification steps. The rule filters out common legitimate entries to reduce false positives.
Page 278 of 680