SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,603 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the GMER tool, a rootkit detector and remover, based on its executable name and known file hashes. This tool can be used by adversaries to impair defenses by identifying and disabling security software or hidden processes.
Detects the execution of the LocalPotato Proof-of-Concept (POC) tool. This detection is based on specific characteristics of the executable's image name, command-line arguments, and known import hashes (IMPHASH) associated with LocalPotato. The tool is known for exploiting vulnerabilities to achieve privilege escalation.
This rule detects the execution of the IOX tunneling tool, which is used for port forwarding and intranet proxy purposes. It specifically looks for the executable name 'iox.exe' and common command-line arguments associated with its forwarding and proxy functionalities, such as '.exe fwd -l', '.exe fwd -r', '.exe proxy -l', and '.exe proxy -r'. Additionally, it includes specific MD5, SHA1, and SHA256 hashes for version 0.4 of the tool to enhance detection accuracy.
Detects the execution of 'nimgrab.exe', a tool often bundled with the Nim programming framework and used for downloading files. This activity can indicate an adversary transferring tools or other files into a compromised environment.
Detects the execution of 'npc.exe', the client component of NPS (a port forwarding and intranet penetration proxy server). Detection is based on the executable name, specific command-line arguments indicative of server connection and authentication, or known hashes of the 'npc.exe' client.
Detects the execution of 'client32.exe', a component of the NetSupport Remote Control tool, when it is launched from an unusual directory outside of the standard 'C:\Program Files' or 'C:\Program Files (x86)' paths. This behavior can indicate an adversary attempting to evade detection by placing legitimate remote access tools in non-standard locations.
Detects the execution of a Proof-of-Concept (PoC) tool named 'SysmonEOP.exe' or a variant identified by specific IMPHASH values. This tool is designed to exploit CVE-2022-41120, a vulnerability in Sysmon that can lead to privilege escalation.
Detects the execution of 'mpiexec.exe' from the HPC pack with specific command-line flags ('/n 1' or '-n 1'). This combination indicates an attempt to abuse 'mpiexec.exe' as a LOLBIN (Living Off the Land Binary) to proxy the execution of other binaries, potentially bypassing security controls.
Detects password policy discovery commands
Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)
Page 377 of 680