SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,520 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of certutil.exe with the "-decode" or "-decodehex" flags to decode base64 or hex encoded files. This technique is commonly abused by attackers to deobfuscate and prepare encoded payloads for execution, often as part of defense evasion tactics.
Detects the execution of certutil.exe with the "-encode" flag to encode a file to base64, specifically when the file has a suspicious extension. This activity can be indicative of an adversary attempting to obfuscate malicious files or exfiltrate data.
This rule detects suspicious execution of msiexec.exe with the '-y' or '/y' flag, which can be abused to execute arbitrary DLLs. Adversaries may use this technique to bypass application control or proxy execution of malicious payloads. The rule filters out known legitimate uses by Apple Bonjour and Apple Software Update, as well as Microsoft System Center Configuration Manager (SCCM).
Detects the execution of 'odbcconf.exe' with the '-f' flag to load a response file that does not have a '.rsp' extension. This behavior is suspicious as it deviates from the typical use of odbcconf.exe and can be leveraged by adversaries for defense evasion, specifically to proxy execution of malicious payloads.
Detects the export of a target Registry key to a file using 'regedit.exe' with the '-E' command-line argument. This rule specifically filters out common critical keys (HKLM\SYSTEM, HKLM\SAM, HKLM\SECURITY) to reduce false positives and focus on other potentially malicious registry exports.
Detects the execution of a renamed ProcDump executable. This is often done by attackers or malware in order to evade defensive mechanisms. The rule looks for processes with an original filename of 'procdump' or command-line arguments indicative of ProcDump usage (e.g., '-ma', '-mp', '/accepteula'), while filtering out executions where the image name is still 'procdump.exe' or 'procdump64.exe'.
This rule detects suspicious activity involving `CertOC.exe` loading a DLL from unusual or temporary paths. `CertOC.exe` is a legitimate Windows binary used for certificate operations, but it can be abused to load arbitrary DLLs, a technique often used for defense evasion or privilege escalation. The rule specifically looks for `CertOC.exe` being executed with the `-LoadDLL` command-line argument, combined with the DLL path being located in common temporary or user-writable directories like `AppData\Local\Temp`, `Desktop`, `Downloads`, `Users\Public`, `C:\Windows\Tasks`, or `C:\Windows\Temp`.
Detects the execution of 'ftp.exe' with the '-s' or '/s' flag, which indicates script execution, or any child processes spawned by 'ftp.exe'. This behavior can be abused by adversaries for arbitrary command execution, often as a method of defense evasion or indirect command execution.
Detects the execution of `certutil.exe` with the "-encode" flag to encode a file to Base64. This rule specifically triggers when the input file is located in potentially suspicious directories such as `AppData\Roaming\`, `Desktop\`, `Local\Temp\`, `PerfLogs\`, `Users\Public\`, `Windows\Temp\`, or `$Recycle.Bin`. This activity is often indicative of defense evasion, where attackers obfuscate malicious payloads to bypass security controls or hide their activities.
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost". This technique can be used for defense evasion by obscuring the true parent process.
Page 286 of 680