SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,542 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of `findstr.exe` with both the `/s` (search subfolders) and `/i` (case-insensitive search) flags. Adversaries commonly use `findstr.exe` as a living-off-the-land binary (LOLBIN) to search for sensitive information, configuration files, or other interesting data within a compromised system, often filtering through command output or file contents.
Detects the execution of 'lodctr.exe' with the '-r' flag, which is used to rebuild performance counter registry values. Attackers can abuse this utility by providing a malicious configuration file to overwrite performance counter configurations, potentially confusing or evading monitoring and security solutions.
This rule detects the execution of msiexec.exe with command-line arguments indicative of a quiet installation. Adversaries often abuse msiexec.exe, the Windows Installer command-line utility, to proxy the execution of malicious payloads. The rule specifically looks for msiexec.exe being executed with installation-related flags such as '-i', '-package', '-a', or '-j', combined with the quiet installation flag '-q'. It filters out common legitimate scenarios where msiexec.exe might be used in temporary user or system directories, or by the System Center Configuration Manager (SCCM).
Detects unknown programs attempting to escalate privileges to LOCAL SYSTEM by using command-line arguments commonly associated with tools like PsExec and PAExec. The rule specifically looks for combinations of '-s' (run as SYSTEM) and '-i' (interact with desktop) flags followed by common shell executables like 'cmd', 'pwsh', or 'powershell'. It filters out known instances of 'paexec' and 'PsExec' to avoid overlap with more specific rules.
Detects the enumeration of loaded modules or DLLs within processes using 'tasklist.exe' with the '-m' flag. This activity is often performed by attackers to identify the Process ID (PID) associated with a specific DLL (e.g., 'rdpcorets.dll') for subsequent actions like dumping process memory to extract credentials.
This rule detects the execution of the built-in Windows utility "whoami.exe" specifically when used with the "/all" flag. This command is often used by attackers during the discovery phase to gather extensive information about the current user, including user name, security identifiers (SIDs), groups, and privileges. This detailed information can help an adversary understand their current access level and plan subsequent actions.
This rule detects the use of the `curl` command-line tool to download a file from a remote HTTP/HTTPS source and immediately execute it. The detection logic specifically looks for `curl` in the command line, followed by an HTTP/HTTPS URL, the `-o` (output file) flag, and an `&` character, which often indicates command chaining for immediate execution. This behavior is commonly observed in adversaries attempting to transfer and execute malicious payloads.
Detects the execution of "Diskshadow.exe" in script mode with a potentially uncommon script extension. This rule requires initial baselining of allowed script extensions to minimize false positives. Adversaries may use Diskshadow.exe, a legitimate Windows utility, to proxy execution of malicious scripts, often as a defense evasion technique.
Detects the use of 'replace.exe' with the '-a' argument, which is used to add new files to the destination directory. This utility can be abused by adversaries to replace or add files on a system, potentially for persistence, defense evasion, or to introduce malicious tools.
Detects the usage of the 'unregmp2.exe' binary as a proxy to launch a custom version of 'wmpnscfg.exe' by looking for the '/HideWMP' command-line argument. This technique is often used for defense evasion.
Page 287 of 680