SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,601 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the BCP utility to export data from a Microsoft SQL Server database. Attackers may use this method to extract malware previously saved into a database column or table, or to exfiltrate sensitive data from the database.
This rule detects the addition of an AppX package to the processing pipeline where the package's source path contains domains commonly associated with file sharing, code hosting, or temporary storage services. Adversaries often leverage these services to host malicious payloads, including AppX packages, to bypass traditional security controls or to deliver malware. The rule specifically looks for EventID 854 from the 'AppXDeployment-Server' log source and checks if the 'Path' field contains any of the listed suspicious domains.
Detects the use of GCC (or C89/C99) with the '-wrapper' option to execute a shell, which can be leveraged for privilege escalation, unauthorized command execution, or to break out from restricted environments. This technique is often documented in resources like GTFOBins.
Detects the execution of the Doppelganger hacktool, which is designed to dump LSASS memory by cloning processes to evade common detection methods. The rule identifies this activity by looking for specific executable names or known ImpHash values associated with the Doppelganger tool.
Detects the use of the 'find' command in Linux to execute a shell. This behavior is often associated with privilege escalation, unauthorized command execution, or exploitation attempts, particularly when leveraging misconfigurations or vulnerabilities to break out of restricted environments.
This rule detects the execution of 'vshadow.exe' with the '-exec' parameter. The VShadow tool is used to create and manage volume shadow copies, and the '-exec' parameter allows for the execution of a specified script or command after shadow copies are created but before VShadow exits. While this functionality can be used legitimately for backup or administrative tasks, attackers can abuse it to proxy the execution of malicious code, thereby bypassing security controls or achieving defense evasion.
Detects attempts to hide a user account from the Windows logon screen by modifying the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList' registry key. Specifically, this rule looks for the use of 'reg.exe' to add a value of '0' to this key, which effectively hides the specified user account.
Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign, often used with an append redirection operator ">>" to update file content indirectly. This technique can be used by attackers to append data to files, as demonstrated by the example: `cmd /c >> example.txt set /p="test data"` which appends "test data" to "example.txt". The rule specifically looks for `cmd.exe` executions containing `/c set /p=` or `"set /p=` or `>>*set /p=` in the command line.
This rule detects the execution of the 'capsh' utility followed by a double dash ('--'), which is a common pattern used to invoke a shell through 'capsh'. This technique can be used by adversaries to bypass restricted shell environments or escalate privileges by leveraging 'capsh' capabilities.
Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading. This action is typically performed by adversaries to bypass Hypervisor-Protected Code Integrity (HVCI) and load unsigned or malicious drivers.
Page 300 of 680