SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,520 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the expansion or decompression of cabinet files using 'expand.exe' from potentially suspicious or uncommon locations. This activity has been observed in attacks such as those related to Iranian MeteorExpress and Konni malware.
This rule detects the creation of self-extracting packages using iexpress.exe when the Self Extraction Directive (SED) file is located in potentially suspicious directories such as ProgramData, Temp, or Windows Tasks folders. This activity has been observed in-the-wild by various threat actors for defense evasion and payload delivery.
This rule detects the execution of msiexec.exe attempting to load a DLL and call its DllUnregisterServer function. This behavior is often abused by adversaries for defense evasion and proxy execution, as msiexec.exe is a legitimate Windows utility. The detection specifically looks for msiexec.exe being executed with the '-z' flag and a command line containing '.dll', indicating an attempt to unregister a DLL.
Detects attempts to disable the Windows Recovery Environment (WinRE) using the `reagentc.exe` command-line tool with the `/disable` argument. Disabling WinRE can prevent system recovery and troubleshooting, which is a common tactic used by adversaries to hinder incident response and recovery efforts.
Detects when 'CertOC.exe' is used to load a DLL, which can be an indicator of System Binary Proxy Execution. Adversaries may abuse trusted Microsoft-signed binaries like CertOC.exe to bypass defenses and execute malicious code.
Detects suspicious installations of IIS native-code modules via the command line using `appcmd.exe`. This activity can be indicative of an adversary establishing persistence on a web server by installing malicious components or backdoors. The rule specifically looks for `appcmd.exe` executing with `install` and `module` in the command line, along with the `-name:` parameter, while filtering out legitimate installations performed by `iissetup.exe`.
Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands, as seen in the Follina (CVE-2022-30190) vulnerability. The rule specifically looks for execution of msdt.exe combined with command-line arguments indicative of arbitrary command execution, either through an inline command or by specifying an answer file.
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory. This tool, while legitimate, can be abused by adversaries to extract sensitive information, such as credentials, from process memory. The rule specifically looks for the execution of rdrleakdiag.exe with command-line arguments indicative of memory dumping, such as '/memdmp' or 'fullmemdmp', along with output and process specification arguments.
This rule detects the use of 'Rpcping.exe' to force NTLM authentication by sending an RPC test connection to a target server. This technique can be used by attackers to capture NTLM hashes, which can then be cracked offline to obtain user credentials.
This rule detects the execution of commands that include the ' -accepteula' flag. This flag is commonly used by Sysinternals tools to automatically accept their End User License Agreement (EULA), allowing for non-interactive execution. The presence of this flag in a command line can indicate the use of Sysinternals utilities, which are legitimate administrative tools but are also frequently leveraged by adversaries for various post-exploitation activities.
Page 285 of 680