SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,602 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the "RunMRU" registry key. This technique has been observed in campaigns where threat actors trick users into pasting and executing malicious commands, often under the guise of CAPTCHA verification steps, to deliver malware like Lumma Stealer.
Detects the use of `csrutil` with the `status` argument to view the System Integrity Protection (SIP) status on macOS. This activity is often observed in post-exploitation scenarios where an adversary is attempting to understand the system's security posture, specifically whether SIP is enabled or disabled, which could impact their ability to perform certain actions like modifying system files or injecting code.
Detects when the `csrutil` command is used with the `disable` argument to turn off System Integrity Protection (SIP) on macOS. This action is often performed in post-exploitation scenarios by adversaries to gain greater control over the system or to bypass security mechanisms.
This rule detects the use of the `ioreg` command-line utility on macOS, which is used to display I/O Kit registry information. Adversaries often use `ioreg` for system information discovery, particularly to identify virtualization environments (e.g., VirtualBox, VMware, Parallels) or other system details like serial numbers or USB device information. The rule specifically looks for executions of `ioreg` combined with common arguments and keywords used for such discovery, either directly or through shell commands involving `grep`.
This rule detects the execution of the 'sw_vers' command-line utility on macOS systems when specific arguments are used to query system information. The arguments monitored include '-buildVersion', '-productName', and '-productVersion', which are commonly used for system information discovery.
Detects file write events from or to a fake Recycle.Bin folder, which is often used by malware as a staging directory. Adversaries may create folders with names similar to legitimate system directories (e.g., "RECYCLERS.BIN" instead of "RECYCLER.BIN") to hide their malicious files and evade detection.
Detects the execution of the "cloudflared" tool with the "tunnel cleanup" command. This command is used to remove Cloudflare Tunnel connections, which could be an indicator of an adversary attempting to remove traces of their C2 infrastructure or clean up after an operation. The rule looks for specific command-line arguments including 'tunnel', 'cleanup', and either '-config' or '-connector-id'.
This rule detects the execution of 'tar.exe' with command-line arguments indicative of creating a compressed archive. Specifically, it looks for the '-c' (create), '-r' (append or update), or '-u' (update) flags. This activity is often associated with adversaries compressing data before exfiltration.
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. This technique can be used for defense evasion by masquerading the execution of arbitrary commands.
Detects the use of rar.exe to create an archive with a password and recursive flag, specifically targeting system folders or common staging directories. This behavior is often associated with attackers collecting and preparing data for exfiltration.
Page 382 of 680