SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,617 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups.
Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
This rule detects process executions that exhibit patterns commonly associated with China Chopper-like tiny webshells, specifically when they are spawned by the w3wp.exe process (IIS worker process). The detection logic looks for specific command-line arguments that include common discovery and system information commands such as 'ipconfig', 'quser', 'whoami', 'c:', 'cd', 'dir', and echo commands, often used by webshells to interact with the compromised system.
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output (specifically LSASS memory dumps) get renamed, or a dump file is moved or copied to a different name. This behavior is often used by adversaries to evade detection when performing credential dumping.
Detects suspicious child processes spawned by web servers, indicating potential webshell activity used for credential dumping, exfiltration, or other post-exploitation actions. The rule looks for specific command-line patterns and executables commonly associated with these malicious activities originating from known web server processes.
WinPEAS is a widely used privilege escalation and discovery tool. This rule detects the execution of winPEAS by monitoring process creation events for specific filenames and command-line arguments. It also looks for command-line options related to information gathering (applications, browser, events, files, processes, services, windows credentials) and attempts to download the tool from its GitHub repository. The rule aims to identify potential privilege escalation attempts and extensive system discovery activities by adversaries.
Detects the execution of 'createdump.exe' or a renamed version of it, specifically when used to dump process memory. The rule looks for the original internal filename 'FX_VER_INTERNALNAME_STR' and command-line arguments indicative of memory dumping, such as '-u' or '--full' combined with '-f' or '--name' and a '.dmp' extension. This technique is often used by adversaries to extract credentials from processes like LSASS.
This rule detects suspicious command-line activity originating from common web server processes, indicative of web shell usage for reconnaissance and system interaction. It looks for specific utilities and command-line arguments often used by attackers to discover system information, user accounts, network configurations, and execute arbitrary commands through a compromised web server.
Detects HandleKatz, a tool designed to duplicate the LSASS process handle with specific access rights (PROCESS_DUP_HANDLE, PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_QUERY_INFORMATION) to later dump its memory without opening new handles. The detection logic focuses on the target image being 'lsass.exe', the specific granted access rights, and a suspicious call trace originating from ntdll.dll with an 'UNKNOWN' module.
Detects the use of 'createdump.exe', a legitimate Windows utility, to dump process memory. This technique is often used by adversaries to extract credentials from processes like LSASS. The rule specifically looks for the execution of 'createdump.exe' or its original filename 'FX_VER_INTERNALNAME_STR' combined with command-line arguments indicative of a memory dump operation, such as '-u', '--full', '-f', '--name', or '.dmp'.
Page 345 of 680