SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,616 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from an uncommon parent location. This behavior can indicate privilege escalation or defense evasion by an attacker.
Detects the use of Windows API (WinAPI) functions being called directly via the command line. This technique is often used by threat actors, for example, with tools like winapiexec, to perform various malicious actions such as privilege escalation, process injection, or credential dumping by directly interacting with low-level operating system functions. The rule specifically looks for a wide range of sensitive WinAPI function names and DLLs in the command line arguments of newly created processes.
Detects the execution of 'whoami.exe' when its parent process is not a common legitimate shell or application, or when the parent process information is missing. This can indicate suspicious activity, as 'whoami.exe' is often used by attackers for discovery purposes.
Detects the use of the 'Get-ADComputer' cmdlet with specific parameters or LDAP filters to identify systems configured for unconstrained delegation. This activity is often performed by adversaries during the reconnaissance phase to find targets for Kerberos-based attacks like credential theft.
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity. The rule specifically looks for conhost.exe being spawned by processes other than a predefined list of common and legitimate parents, while also filtering out specific command-line patterns for svchost.exe and Dropbox to reduce false positives.
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D).
Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.
The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.
This rule flags suspicious use of such padding observed in real-world attacks.
Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.
The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.
This rule flags suspicious use of such padding observed in real-world attacks.
Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil".
An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.
An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.
Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility.
An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.
An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Page 351 of 680