SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,617 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the XORDump utility, a tool used for dumping process memory, specifically targeting LSASS or using common DLLs for memory dumping like comsvcs, dbghelp, or dbgcore. This activity is indicative of credential access attempts.
Procdump Execution
Sigma
Detects the execution of the SysInternals Procdump utility. Procdump can be used by adversaries to dump process memory, including sensitive processes like LSASS, for credential access.
Detects the execution of 'DumpMinitool.exe', a tool used to dump process memory, specifically targeting the 'MiniDumpWriteDump' function. This tool can be used to extract credentials from processes like LSASS.
Detects suspicious execution of 'DumpMinitool.exe', a binary that can be used for credential dumping. The rule looks for executions outside of typical Visual Studio directories, or executions with command-line arguments indicative of memory dumping (e.g., '.txt', 'Full', 'Mini', 'WithHeap') unless the '--dumpType' flag is also present, which might indicate legitimate usage.
This rule detects potential attempts to steal browser data by monitoring process creation events for specific command-line utilities (copy, move, xcopy, robocopy, esentutl) combined with paths commonly associated with web browser user data directories. Adversaries often acquire credentials from web browsers by copying or moving these files, which may contain saved usernames and passwords.
This rule detects the execution of known Proof-of-Concept (PoC) executables for the ZeroLogon vulnerability (CVE-2020-1472). It specifically looks for `cmd.exe` spawning executables named `cool.exe` or `zero.exe` with command-line arguments indicating administrative context and execution flags. Additionally, it identifies subsequent actions such as `taskkill` commands or `powershell` execution, which are common post-exploitation activities after successful ZeroLogon exploitation.
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique is used by threat actors and ransomware strains to evade defenses by removing forensic evidence.
Detects the dropping and potential execution of DarkGate loader components, specifically AutoIt scripts (.au3) or compiled AutoIt executables (autoit3.exe), within the C:\temp directory. This activity is indicative of DarkGate malware infection attempts, often leveraging vulnerabilities like CVE-2024-21412.
Detects programs that connect to known malware callback ports based on threat intelligence reports. This rule specifically targets Linux systems and filters out connections to common local IP ranges to reduce false positives.
Page 346 of 680