SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,520 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the use of PsExec or PAExec with command-line flags designed to escalate privileges to the LOCAL_SYSTEM account. Specifically, it looks for the '-s' flag, optionally combined with '-i', followed by common shell executables like 'cmd', 'powershell', or 'pwsh'. This behavior is indicative of an attempt to gain SYSTEM-level access on a Windows machine.
Detects a potentially suspicious one-liner command combining 'ping' and 'copy' within a 'cmd.exe' process. This combination is often used by malware for purposes such as network reconnaissance followed by data staging or exfiltration, or as a defense evasion technique by leveraging common system utilities in an unusual manner. The rule specifically looks for the presence of 'ping' and 'copy ' along with either the '-n' (count) or '-y' (yes to overwrite) flags in the command line.
This rule detects the execution of `wmic.exe` with the `-format` flag, specifically looking for instances where the format specified is not one of the commonly known, legitimate WMIC output formats (e.g., List, htable, mof, xml, csv). Adversaries can abuse this functionality to load and execute malicious XSL (Extensible Stylesheet Language) files, potentially bypassing application whitelisting defenses. This technique is often referred to as "Squiblytwo" and leverages WMIC to invoke JScript or VBScript embedded within an XSL file.
Detects the execution of built-in Windows commands "del" or "erase" to delete files. Adversaries often delete files to remove traces of their intrusion activity, minimize their footprint, or clean up after malware execution. This rule specifically looks for `cmd.exe` executing these commands, potentially with flags like `-f` (force delete), `-s` (delete from subdirectories), or `-q` (quiet mode).
Detects the execution of 'msdt.exe' with the '-cab' flag, which is indicative of suspicious diagnostic cabinet (.diagcab) files potentially leveraging CVE-2022-30190 (Follina vulnerability) to execute embedded answer files. This technique can be used for defense evasion and indirect command execution.
Detects the execution of 'certutil.exe' with the '-addstore' flag and 'root' in the command line, indicating an attempt to install a new root certificate on the system. Adversaries may use this technique to establish trust for their own certificates, bypassing security warnings when connecting to adversary-controlled web servers or for code signing.
Detects a suspicious command-line pattern often used by ransomware, where the 'ping' command is used with a delay (e.g., '-n 3') to introduce a pause, immediately followed by the 'del' command with force and quiet flags ('-f -q') to delete a file. This technique is typically employed to hide the initial infection vector or other malicious files by deleting them after execution.
Detects the usage of "cmdkey.exe" with the '-g', '-u', and '-p' command-line arguments to add new generic credentials. This activity can be used by adversaries to store credentials for later use, potentially before connecting to remote services like RDP.
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag, where the script is located in a potentially suspicious directory such as temporary folders or user application data directories. This behavior is often associated with defense evasion and system recovery inhibition by adversaries.
This rule detects the use of 'esentutl.exe' with specific command-line arguments to extract browser data, particularly from the Windows WebCache. This activity is associated with malware like Qbot, which uses this technique to steal sensitive information from browsers such as Internet Explorer and Microsoft Edge.
Page 284 of 680