SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,601 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious command-line strings within the 'TypedPaths' registry key, specifically targeting entries associated with web browsers. This behavior is indicative of the "FileFix" technique, where users are tricked into pasting malicious commands into browser file upload dialogs. The rule looks for common command-line utilities like 'cmd', 'curl', 'powershell', 'bitsadmin', 'certutil', 'mshta', and 'regsvr32' within the 'url1' value of the 'TypedPaths' key, combined with the presence of a '#' character, which often signifies a comment or a separator in such malicious constructs.
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
Detects suspicious process executions where Sysmon itself is the parent of a newly created process. This behavior can indicate an exploitation attempt, such as the one described in CVE-2022-41120, where an attacker might leverage a vulnerability in Sysmon to execute arbitrary code with elevated privileges. The rule filters out legitimate Sysmon processes and known system processes that might legitimately be children of Sysmon.
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks, red-teaming tools, and malware. This rule identifies a wide range of offensive PowerShell functions used for reconnaissance, credential dumping, privilege escalation, persistence, and data exfiltration.
Detects uncommon processes creating remote threads. This rule specifically looks for remote thread creation events where the source image is one of a predefined list of common Windows executables (explorer.exe, iexplore.exe, msiexec.exe, powerpnt.exe, schtasks.exe, winlogon.exe) and filters out known legitimate behaviors for these processes to reduce false positives. This activity can be indicative of process injection techniques used by malware or adversaries.
Detects PowerShell creating executable files or script files. This rule specifically looks for PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) writing files with common executable or script extensions to disk, while filtering out common temporary file locations and PowerShell module paths to reduce false positives.
Detects remote thread creation in uncommon target processes such as 'calc.exe', 'notepad.exe', 'mspaint.exe', 'ping.exe', 'sethc.exe', 'spoolsv.exe', 'wordpad.exe', and 'write.exe'. This activity can indicate process injection techniques used for defense evasion or privilege escalation.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
Page 298 of 680