SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,605 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the "pbpaste" utility on macOS. This utility retrieves the contents of the clipboard and writes them to standard output. Attackers can abuse this utility to collect sensitive data, such as passwords or other confidential information, from the user's clipboard. The rule is designed to hunt for potential malicious use of pbpaste by examining the parent process and command-line arguments for suspicious activity.
Detects when Kubernetes Secrets are created, modified, or deleted. This activity is critical to monitor as secrets often contain sensitive information like API keys, passwords, and OAuth tokens. Unauthorized modification or deletion of these secrets could lead to credential compromise, unauthorized access, or denial of service within a Kubernetes cluster.
Detects the execution of "aspnet_compiler.exe" when it attempts to compile files from potentially suspicious or user-writable directories. This behavior can indicate an adversary using a trusted developer utility for defense evasion or to execute malicious code.
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics such as image name, original file name, or description containing 'Crassus'. This tool is used for reconnaissance and discovery activities on a compromised system.
Detects the execution of 'TruffleSnout.exe', a tool designed for iterative Active Directory discovery, situational awareness, and targeted low-noise enumeration. This rule identifies the tool by its original filename or by the executable's image path ending with 'TruffleSnout.exe'.
Detects potential command-line obfuscation using Unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This rule specifically looks for the use of various Unicode characters that can be used to obscure commands executed by common Windows command-line interpreters and scripting engines.
Detects the execution of AddInUtil.exe, a legitimate Microsoft utility for updating Add-In deployment caches, from a directory that is not a standard Microsoft .NET Framework or WinSxS location. Adversaries may abuse this utility to proxy execution of malicious code, bypass application whitelisting, or evade defenses.
This rule detects suspicious process creation patterns that may indicate FIN7 exploitation activity. Specifically, it looks for `cmd.exe` being spawned by `notepad++.exe` or `notepad++.exe` being spawned by `rdpinit.exe`. These process relationships are indicative of potential post-exploitation actions after initial access, possibly via compromised RDP credentials as described in the referenced Google blog.
Detects the use of the PowerShell cmdlet 'Get-StorageDiagnosticInfo' with the '-IncludeLiveDump' parameter to dump the live memory of a Windows machine. This technique can be used by adversaries to extract sensitive information, including credentials, from memory.
Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
Page 321 of 680