SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,598 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects PowerShell download and execution cradles.
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Detects potential PowerShell commands or code within registry run keys
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
Detects potentially suspicious subprocesses such as LOLBINs spawned by web browsers. This activity could be associated with the "FileFix" social engineering technique, where users are tricked into launching the file explorer via a browser-based phishing page and pasting malicious commands into the address bar. The technique abuses clipboard manipulation and disguises command execution as benign file path access, resulting in covert execution of system utilities.
Detects DNS queries for specific subdomains associated with the "Put.io" sharing website. This activity could indicate command and control communication, data exfiltration, or other malicious use by adversaries.
Detects the initial execution of FakeUpdates/SocGholish malware. This rule identifies scenarios where 'wscript.exe' is used as a parent process to execute a JavaScript file from the 'AppData\Local\Temp' directory, often containing 'update' and '.zip' in its command line, and subsequently spawns 'cmd.exe' or 'powershell.exe'. The presence of browser names in the parent command line further indicates a drive-by download infection vector.
This rule detects when the user risk and multi-factor authentication (MFA) registration policy is updated within Azure Active Directory (AAD). Attackers may modify these policies to bypass MFA, weaken security thresholds, facilitate further attacks, or maintain persistence by altering how users authenticate or register for MFA.
Detects a suspicious WinRAR execution in a folder which is not the default installation folder
Detects the Emotet Epoch4 loader as reported by @malware_traffic in 2022. This specific detection focuses on the execution chain involving a .LNK file delivered via a phishing campaign, which then uses `cmd.exe` or `powershell.exe` to execute commands containing `findstr`, `.vbs`, and `.lnk` in the command line. This indicates an attempt to locate and execute a VBScript from within the LNK file context, a common technique for malware like Emotet to achieve initial execution.
Page 299 of 680