SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,477 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes.
Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.
Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.
Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.
Detects LOLBINs and applications that should not legitimately drop script files to disk.
This may indicate malware staging or abuse of a trusted binary for script-based code execution.
This may indicate malware staging or abuse of a trusted binary for script-based code execution.
Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".
An adversary might use WMI to check if a certain remote service is running on a remote device.
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable
Detects the execution of WMIC to query information on a remote system
Detects usage of wmic to start or stop a service
Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.).
This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.
Detects the removal or uninstallation of an application via "Wmic.EXE".
Page 29 of 680