SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,617 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns
Detects the execution of the CSharp interactive console (csi.exe) when it is spawned by PowerShell. This activity can be indicative of an adversary leveraging trusted developer utilities for proxy execution, potentially to bypass application controls or execute malicious code.
Detects outbound network connections initiated by `dialer.exe`, an outdated Microsoft utility. This process is known to be targeted by info-stealers for process injection and used to establish command and control (C2) connections, with Rhadamanthys being a common example. The rule filters out connections to common local and private IP ranges to reduce false positives.
Detects the execution and usage of the DSInternals PowerShell module. This module can be used to perform suspicious activities such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, recovering domain controllers from IFM backups, and calculating password hashes. The rule specifically looks for a wide range of cmdlets associated with the DSInternals module within PowerShell script block logs.
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803". Adversaries might enable this feature to collect system registry hives, which can contain sensitive information.
Detects outbound network connections initiated by msbuild.exe to common C2 ports (80, 443), which could indicate the use of Silenttrinity or other MSBuild-based execution for command and control.
Detects a suspicious child process spawning from Microsoft Outlook where the executable image is located on a remote share (SMB/WebDav). This behavior is often associated with adversaries using Outlook to execute malicious code from network shares, potentially as part of persistence or execution techniques.
Detects the execution of AdFind.exe, a legitimate command-line tool often used by adversaries for Active Directory reconnaissance. The rule specifically looks for renamed AdFind executables by checking for specific command-line arguments and known ImpHashes, while excluding executions of the original 'AdFind.exe' name.
Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value where it is set to "1" to disable the Hypervisor Enforced Paging Translation feature. This action can be taken by adversaries to evade detection by security tools that rely on this feature for monitoring or integrity checks, potentially facilitating kernel exploits or rootkit installations.
Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.
Page 339 of 680