SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,477 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.
Detects potentially suspicious file download from file sharing domains using curl.exe
Detects potentially suspicious file downloads from file sharing domains using wget.exe
Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles
Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE.
An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that
automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.
Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.
An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that
automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.
Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.
Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.).
While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software.
The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.
While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software.
The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.
Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.
This could be a sign of obfuscation of a fat finger problem (typo by the developer).
This could be a sign of obfuscation of a fat finger problem (typo by the developer).
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
Page 32 of 680