SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,603 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of UACMe, a tool used for User Account Control (UAC) bypasses, by identifying specific PE metadata (Product, Company, Description, OriginalFileName) or image names. It also includes a selection of known IMPHASH values associated with UACMe's 'Akagi' component.
Detects the execution of known compromised versions of the 3CXDesktopApp by matching specific file hashes (SHA256, SHA1, MD5) or by identifying the executable name, original filename, and product name, potentially combined with a specific file version. This rule aims to identify instances of the supply chain attack that affected 3CXDesktopApp.
Detects the execution of PCHunter, a powerful system utility similar to Process Hacker, which can be used to view and manipulate processes, kernel options, and other low-level system aspects. Its use by unauthorized personnel can indicate malicious activity, system reconnaissance, or attempts to tamper with system internals.
Detects the execution of the 'Impersonate' tool, which is designed to manipulate Windows tokens. This tool can be used to escalate privileges by impersonating other user tokens, either remotely (e.g., via PsExec/WmiExec) or interactively. Detection is based on specific command-line arguments or known hashes of the tool.
Detects the execution of System Informer, a legitimate but powerful task manager tool that can be used to view and manipulate processes, kernel options, and other low-level operations. Its capabilities make it a potential tool for adversaries to gain system information, escalate privileges, or evade defenses.
Detects the execution of Stracciatella, a hack tool that executes PowerShell runspaces from within C# (SharpPick technique) while attempting to disable AMSI, ETW, and Script Block Logging. Detection is based on the executable's name, original filename, description, or specific SHA256 hashes.
This rule detects the execution of NetSupport RAT, specifically looking for instances where the 'client32.exe' component has been renamed. It identifies the RAT by checking for specific product strings ('NetSupport Remote Control'), original file names ('client32.exe'), or a known Imphash (A9D50692E95B79723F3E76FCF70D023E). The rule explicitly excludes legitimate executions of 'client32.exe' to focus on renamed instances, indicating an attempt at defense evasion.
Detects the execution of the `CreateMiniDump.exe` utility or a process with a specific import hash associated with `CreateMiniDump`, which is used to dump the LSASS process memory for credential extraction. This tool is often used by attackers to bypass antivirus signatures that might detect `mimikatz` or similar tools.
Detects the execution of HandleKatz, a tool designed to dump LSASS memory using cloned handles. The rule identifies the tool by its executable name ('loader.exe'), specific command-line arguments including '--pid:', '--outfile:', and keywords like '.dmp', 'lsass', '.obf', or 'dump', and known IMPHASH values associated with HandleKatz.
Detects potential SquiblyTwo attack technique where WMIC is used to execute remote XSL files. This rule specifically looks for WMIC execution with command-line arguments indicating a format specifier and an HTTP URL, combined with checks for the original WMIC executable name or known WMIC ImpHashes, even if the binary is renamed.
Page 376 of 680