SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,603 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of 'tscon.exe' with 'System' integrity level. This combination is indicative of potential RDP session hijacking activity, where an attacker takes over an existing RDP session without needing credentials or prompting the user. The 'tscon.exe' utility is a legitimate Windows tool used to connect to or disconnect from a session on a Remote Desktop Session Host server, but its execution with System integrity is a strong indicator of malicious intent in this context.
Detects the execution of EDRSilencer, a tool that manipulates the Windows Filtering Platform (WFP) to block outbound network traffic from EDR agents. This is identified by monitoring Windows Security Event IDs 5441 (A Windows Filtering Platform filter has been added) or 5447 (A Windows Filtering Platform filter has been changed) in conjunction with the specific filter name 'Custom Outbound Filter' used by EDRSilencer.
Detects an exploitation attempt of CVE-2019-1388, a privilege escalation vulnerability. This involves the UAC consent dialogue (consent.exe) invoking an Internet Explorer process (iexplore.exe) with system-level privileges, indicated by 'System' or 'S-1-16-16384' integrity level and a command line containing ' http'.
Detects exploitation attempts of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries. The rule specifically looks for child processes spawned by WinRAR.exe, where the command line contains a temporary path indicative of the vulnerability (e.g., '\AppData\Local\Temp\Rar$') and a double extension (e.g., '.ext .exe'), combined with the execution of common binaries like cmd.exe, powershell.exe, or scripting hosts.
Detects when a rule has been modified in the Windows Firewall exception list. This can indicate an adversary attempting to bypass host-based firewall controls to enable command and control, lateral movement, or data exfiltration.
Detects the execution of rundll32.exe that leads to an external network connection, specifically looking for known processes used by the Pikabot malware family for command and control (C2) communication. This rule identifies suspicious network activity originating from rundll32.exe when its parent process is one of the specified Windows binaries, which Pikabot has been observed to hijack for C2.
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level, when launched from a potentially suspicious or uncommon parent process or location. This often indicates an adversary performing reconnaissance within an Active Directory environment.
Detects the execution of a binary that has been renamed from its original name, often used by attackers or malware for defense evasion. This rule leverages the Sysmon 'OriginalFileName' datapoint to identify instances where common Windows utilities or attacker tools are executed under a different filename.
Detects attempts to discover password policy information on Linux systems by monitoring access to key configuration files and the execution of 'chage' and 'passwd' commands with specific arguments.
Detects process creation activity related to the Peach Sandstorm APT, specifically looking for a unique string 'QP's\*(58vaP!tF4' in the command line. This string is likely a unique identifier or a specific parameter used by the APT's tools.
Page 370 of 680