SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,602 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.
This rule detects attempts to disable antivirus filter drivers on a "Dev Drive" by setting the 'FltmgrDevDriveAllowAntivirusFilter' registry value to '0x00000000'. This action prevents antivirus mini-filters from inspecting the Dev Drive, potentially allowing malicious activity to go undetected.
This rule detects the execution of "wusa.exe" (Windows Update Standalone Installer) when its parent process is located in suspicious directories. Attackers may leverage wusa.exe to bypass User Account Control (UAC) and elevate privileges by duplicating its access token. The suspicious parent process locations include common temporary directories, public user folders, and specific user profile subdirectories like Favorites, Favourites, Contacts, and Pictures.
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
This rule detects the execution of SimpleHelp remote access software. SimpleHelp is a legitimate desktop support and remote access tool that adversaries may abuse to establish command and control (C2) channels. The rule specifically looks for process creation events where the image path contains "JWrapper-Remote Access" or "JWrapper-Remote Support" and the executable name is "SimpleService.exe". This pattern indicates the execution of the SimpleHelp service component.
Detects potential execution of MeshAgent, a remote access tool, on macOS systems. The rule specifically looks for the '--meshServiceName' argument in the command line, which is indicative of MeshAgent usage. Threat actors often rename the MeshAgent binary to evade detection, making command-line arguments a more reliable indicator.
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. This rule specifically looks for process creation events on macOS where the command line contains '--meshServiceName' or the original filename contains 'meshagent', but the image path does not end with the legitimate '/meshagent' or '/meshagent_osx64' paths. This behavior is indicative of an adversary attempting to bypass detection by masquerading the RMM tool.
This rule detects the creation of hidden files or directories on Linux systems. It specifically looks for common commands like 'mkdir', 'nano', 'touch', 'vi', or 'vim' being executed with arguments that start with a '.' (dot), which is the standard convention for hidden files and directories in Unix-like operating systems. This behavior is often used by adversaries for defense evasion.
Page 303 of 680