SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,564 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the installation of VirtualBox drivers or the initiation of VirtualBox virtual machines. Adversaries, particularly ransomware groups like Ragnar Locker and Maze, have been observed using virtual instances to execute malicious operations, thereby evading detection by security tools on the host system. The rule specifically looks for command-line arguments related to VirtualBox driver components (VBoxRT.dll, VBoxC.dll, VBoxDrv.sys) or commands used to start/control virtual machines ('startvm', 'controlvm').
This rule detects the creation of a Volume Shadow Copy using PowerShell, specifically looking for the `Win32_ShadowCopy` WMI class and the `.Create()` method with the `ClientAccessible` parameter. Adversaries often use Volume Shadow Copies to access or copy the Active Directory domain database (NTDS.dit) to steal credential information, or other sensitive data from the local system.
Detects the execution of REGSVR32.exe with DLL files masquerading as other files
Detects network connections to domains associated with BTunnels, a service that can be abused by attackers to establish reverse shells or persistence on a machine. The rule specifically looks for outbound connections where the destination hostname ends with '.btunnel.co.in'.
Detects the use of MeshAgent to execute commands on the target host, specifically when it spawns command-line interpreters like cmd.exe, powershell.exe, or pwsh.exe. This behavior can be abused by threat actors to execute arbitrary commands directly on a compromised system, potentially leveraging MeshAgent's capabilities to obscure activities.
Detects a Chromium-based browser process being launched with the '--load-extension=' command-line flag. This flag allows an instance of the browser to be started with a custom extension, which can be abused by adversaries for persistence, data exfiltration, or other malicious activities. This technique is often associated with malware like ChromeLoader.
Detects a suspicious process spawning a Chromium-based browser process with the '--load-extension' flag to start an instance with a custom extension. This technique is often used by adversaries to establish persistence or execute malicious code within the browser environment.
Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.
Detects the execution of PowerShell commands from a headless ConHost process. The '--headless' flag is used to hide the console window from the user, which can be leveraged by adversaries for stealthy execution.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.
Page 292 of 680