SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,520 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the initial execution of the Raspberry Robin malware from an external drive. The rule specifically looks for `cmd.exe` as a parent process, executing a command containing `/r` and ending with specific file extensions (like .bin, .ico, .lnk, .lo, .sv, .usb), which then launches `msiexec.exe` with `/q` and a URL (http: or https:). This pattern is indicative of Raspberry Robin's initial infection vector.
Detects the use of the 'chcp' command, typically executed from a command prompt ('cmd.exe'), to discover the system's locale or code page information. This activity is often performed by adversaries as part of host discovery to understand the system's language settings, which can influence subsequent actions.
Detects the export of critical Registry keys (SAM, SECURITY, SYSTEM) to a file using regedit.exe. This activity is often associated with credential dumping or exfiltration of sensitive system information.
Detects the execution of "taskkill.exe" with the /f (force) flag, which is used to forcefully terminate processes. This activity can be leveraged by attackers for data destruction or data encryption for impact, particularly against services like Exchange and SQL Server. The rule includes filters to reduce false positives from common installer behaviors.
Detects attempts to query system information directly from the Windows Registry using 'reg.exe' or PowerShell cmdlets like 'Get-ItemPropertyValue' or 'gpv'. The rule specifically looks for queries related to time zone, network configuration, operating system details, installed programs, Windows Defender status, existing services, and scheduled tasks.
This rule detects the use of 'esentutl.exe' to copy sensitive files containing credential data, such as the Security Account Manager (SAM) database or the NTDS.dit file. It specifically looks for command-line arguments indicative of Volume Shadow Copy operations or direct paths to known sensitive files within the 'config', 'repair', or 'windows\ntds' directories.
Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot.
This rule detects the subsequent execution of commands associated with Raspberry Robin malware. Specifically, it looks for processes where 'fodhelper.exe' is the parent process, and the child process is either 'rundll32.exe' or 'regsvr32.exe'. Additionally, the command line of the child process must contain specific strings like 'odbcconf.exe', 'regsvr', 'shellexec_rundll', and other keywords such as 'installdriver', 'setfiledsndir', or 'vkipdse', combined with specific command-line switches like '/a', '/f', or '/s'. This combination of parent-child processes and command-line arguments is indicative of Raspberry Robin's post-exploitation activities, often involving the abuse of legitimate Windows utilities for defense evasion and execution.
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that delete shadow copies on systems, which can be a defense evasion technique to prevent system recovery. The rule identifies instances where diskshadow.exe is launched with the script execution flag.
Detects the execution of the 'forfiles.exe' utility with the '/c' flag. This behavior, while legitimate, can be abused by adversaries to proxy execution of arbitrary commands or binaries, potentially bypassing application whitelisting controls. This technique is often associated with Living Off The Land Binaries (LOLBAS).
Page 283 of 680