SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,534 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of 'odbcconf.exe' with the '-f' flag, indicating an attempt to load a response file. This technique can be abused by adversaries to execute malicious actions, often as a method of defense evasion or to bypass application controls.
This rule detects the execution of LiveKD, a Sysinternals tool, specifically when used with the "-m" flag. The "-m" flag is used to force a kernel memory dump, which can be leveraged by attackers for credential dumping or other forms of sensitive information extraction from the kernel memory. This activity is highly suspicious in a production environment and could indicate an attempt at defense evasion or credential access.
This rule detects attempts to uninstall Sysmon by monitoring process creation events for Sysmon executables (Sysmon64.exe or Sysmon.exe) being run with the '-u' command-line argument. This activity is often indicative of an adversary attempting to evade detection by removing security tools.
Detects the execution of "Wlrmdr.exe" with the "-u" command line flag, which allows anything passed to it to be an argument of the ShellExecute API, potentially enabling an attacker to execute arbitrary binaries. This detection also identifies uncommon child processes spawned from "Wlrmdr.exe" as a supplementary measure for environments with "ParentImage" telemetry.
Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration
Detects the execution of 'find.exe' or 'findstr.exe' with command-line arguments containing 'lsass'. This activity often indicates reconnaissance for the Local Security Authority Subsystem Service (LSASS) process ID, which is a common precursor to credential dumping attempts.
This rule detects an unusual command-line flag combination for 'regsvr32.exe'. Specifically, it looks for instances where the '/i' flag (install) is used without the '/n' flag (no UI). This combination is often indicative of malicious activity, as legitimate uses of regsvr32.exe with '/i' typically also include '/n' to suppress the user interface.
This rule detects when the Sysmon utility is executed with the '-c' command-line argument, indicating an attempt to update or modify its configuration. Attackers might leverage this to disable or alter Sysmon's monitoring capabilities, thereby evading detection without fully shutting down the service.
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server.
Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Page 288 of 680