SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,617 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the presence of specific emoji characters within the command line arguments of a newly created process. The use of emojis in command lines is highly unusual and could indicate an attempt by an adversary to evade detection by security tools that may not be configured to parse or analyze non-standard characters, or to obfuscate malicious commands. The rule specifically targets a wide range of human-like and animal emojis with various skin tones.
Detects the execution of WMIC to enumerate installed firewall, antivirus, and antispyware products. Adversaries often perform this discovery to understand security controls, plan evasion tactics, or disable protection mechanisms.
Detects when an attacker attempts to disable User Account Control (UAC) notifications by modifying the "UACDisableNotify" registry value. UAC is a critical Windows security feature that prompts users for permission or an administrator password before allowing actions that could affect system operation or change settings. Setting "UACDisableNotify" to 1 suppresses these UAC prompts, which can be leveraged by attackers for privilege escalation or defense evasion.
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky. The rule specifically looks for Qemu command-line arguments indicative of network tunneling or proxying, such as low memory allocation ('-m 1M', '-m 2M', '-m 3M'), network device configuration ('-netdev', 'connect='), and running without a graphical interface ('-nographic'), while filtering out common legitimate use cases like CD-ROM or virtual block device usage.
This rule detects the use of 'wbadmin.exe' to recover files from backups. Adversaries may use this technique to restore sensitive files, such as NTDS.DIT (Active Directory database) or Registry Hives, from backups. These files can then be analyzed offline to extract credentials or other sensitive information, potentially leading to further compromise.
Detects the execution of "AdPlus.exe", a legitimate Windows SDK binary that can be abused as a Living Off The Land Binary (LOLBIN) to dump process memory (potentially including LSASS) or execute arbitrary commands. The rule specifically looks for command-line arguments indicative of these malicious uses, such as dumping process memory, using a config file, or executing inline commands.
Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks.
Detects the use of 'wbadmin.exe' to recover highly sensitive files such as 'NTDS.DIT', 'SAM', 'SECURITY', and 'SYSTEM' hives. Attackers can leverage this utility to dump sensitive files that might contain credential or other sensitive information.
Page 349 of 680