SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,617 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the addition of a new file or path exclusion to macOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up, hindering recovery efforts.
Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location. Adversaries may modify system firewalls to bypass controls limiting network usage, enabling C2 communications, lateral movement, and/or data exfiltration.
This rule detects attempts to gain 'PROCESS_ALL_ACCESS' rights to specific, commonly used Windows processes such as 'calc.exe', 'notepad.exe', and 'mspaint.exe'. Granting 'PROCESS_ALL_ACCESS' provides the requesting process with all possible access rights to the target process, which can be abused by malicious software for process injection, privilege escalation, or defense evasion.
This rule detects the presence of various emoji characters within the command line arguments of a newly created process. The use of emojis in command lines is considered unusual and could indicate an attempt at defense evasion, potentially to bypass signature-based detections or obfuscate malicious commands.
Detects the enabling of the Windows Recall feature by manipulating registry keys using `reg.exe`. This rule specifically looks for commands that either delete the `DisableAIDataAnalysis` registry value or set it to `0` within the `Microsoft\Windows\WindowsAI` path, indicating an attempt to activate the Recall feature. This activity is often associated with post-exploitation discovery and collection by adversaries.
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
This rule detects the use of various emojis within command-line arguments. Adversaries may use uncommon characters, such as emojis, in command lines to evade signature-based detections, obfuscate their activities, or bypass security controls that are not designed to parse or analyze such characters. This technique falls under defense evasion, as it attempts to make malicious commands less conspicuous to automated analysis.
Detects the usage of emojis and various Unicode characters in command-line arguments. This technique can be used by adversaries for defense evasion, specifically to obfuscate commands and avoid detection by signature-based security tools. The rule identifies a wide range of such characters, including colored squares, arrows, playing card symbols, clock faces, chess pieces, dice, hieroglyphs, flags, and modern emojis.
This rule detects the execution of binaries that are named similarly to legitimate Sysinternals tools but lack the expected digital signature or product information. Adversaries often rename their malicious tools to impersonate legitimate software like Sysinternals utilities to evade detection and appear less suspicious.
Detects the execution of obfuscated PowerShell one-liners designed to download and execute PowerShell modules in memory. This rule specifically looks for PowerShell command lines containing a URL (e.g., 'http://127.0.0.1'), the 'IRM' (Invoke-RestMethod) alias within a loop ('%{(IRM $_)}'), and the 'Invoke' keyword, which are indicative of in-memory module execution.
Page 348 of 680