SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,602 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when a process attempts to delete its own executable file. This action is often difficult to perform directly and can be a tactic used by malware to remove its traces from a compromised system, making forensic analysis harder.
Detects the execution of 'explorer.exe' to open the 'My Computer' folder, initiated by command-line interpreters like 'cmd.exe' or PowerShell. This behavior can be used by adversaries for discovery purposes, specifically to enumerate local drives and resources.
Detects attackers using tooling with bad operational security (opsec) defaults, specifically when spawning sacrificial processes like WerFault.exe, rundll32.exe, regsvcs.exe, regasm.exe, or regsvr32.exe without expected arguments. This behavior is often indicative of process injection or other malicious activities where the attacker fails to mimic legitimate process execution, making it easier to detect. Examples include Cobalt Strike's default use of rundll32.exe without arguments or the Kraken attack abusing WerFault without arguments.
Detects suspicious child processes spawned by wermgr.exe (Windows Error Reporting manager). Adversaries may abuse wermgr.exe to execute arbitrary commands or scripts, often as a method of defense evasion or privilege escalation. The rule specifically looks for common command-line utilities and scripting engines being launched as children of wermgr.exe, while filtering out known legitimate rundll32.exe activity related to WerConCpl.dll.
Detects the execution of the hdiutil utility with the 'create' argument, indicating the creation of a disk image on macOS. This activity can be associated with data staging or exfiltration techniques.
This rule detects the manual execution of a script from inside a compressed file (ZIP/RAR) on Windows. It identifies scenarios where a user interacts with a compressed file, causing a script to be extracted to a temporary directory and then executed by common scripting interpreters like cscript, wscript, powershell, pwsh, or mshta. The rule covers execution initiated by 7zip, WinRar, or the native Windows File Explorer.
Detects the use of 'bitsadmin.exe' to download files from domains commonly associated with file-sharing services or attacker-controlled infrastructure. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
Detects the execution of 'certutil.exe' with specific command-line flags ('urlcache' or 'verifyctl') used to download files from known file-sharing or content delivery websites. This technique is often leveraged by adversaries to transfer malicious tools or payloads into a compromised environment, bypassing traditional security controls.
Detection rule generated by AI system
Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. These tools leverage Windows Server Update Services (WSUS) to achieve lateral movement, often by injecting malicious payloads or approving updates to distribute malware. The rule specifically looks for command-line arguments indicative of these tools' operations, such as '-Inject', '-PayloadArgs', '-PayloadFile' for WSUSpendu, and 'approve', 'create', 'check', 'delete', '/payload:', '/updateid:' for SharpWSUS.
Page 302 of 680