SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,602 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to tamper with Windows Defender settings using PowerShell's Set-MpPreference cmdlet. Specifically, it looks for commands that disable various Defender features like real-time monitoring, behavior monitoring, archive scanning, or set default threat actions to 'Allow'. This activity is indicative of an adversary trying to impair defensive capabilities on a system.
This rule detects the execution of 'tar.exe' with the '-x' command-line argument, indicating an attempt to extract compressed files. Adversaries often use legitimate utilities like 'tar.exe' to decompress data, which can help them avoid detection and prepare collected data for further actions like exfiltration. The rule specifically looks for the 'tar.exe' image or an original filename of 'bsdtar' combined with the extraction flag.
This rule detects potential direct system calls to NtOpenProcess, specifically when the CallTrace starts with 'UNKNOWN'. This behavior can be indicative of advanced persistent threats (APTs) or malware attempting to evade detection by bypassing user-mode API hooks. The rule includes several filters to reduce false positives from legitimate applications and system processes.
This rule detects command-line activity that attempts to access sensitive Microsoft Teams files, specifically the Cookies or Local Storage\leveldb directories. These locations can contain authentication tokens and other sensitive information. The rule specifically looks for processes other than the legitimate Teams.exe accessing these paths, indicating potential credential theft or unauthorized access.
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.
Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. This rule specifically looks for the `Set-MpPreference` cmdlet combined with various parameters that disable Defender features or set threat actions to 'Allow'.
Detects the execution of 'dotnet-trace.exe' with command-line arguments indicative of proxy execution, specifically when it's used to collect traces for another process. This technique can be abused by adversaries to bypass defenses by leveraging a trusted Microsoft-signed binary to execute malicious code or actions.
Detects process execution from a fake recycle bin folder, which is a common technique used by adversaries to evade security solutions and hide malicious executables. The rule specifically looks for process images (executables) located within paths containing 'RECYCLERS.BIN\' or 'RECYCLER.BIN\'.
Detects changes to the PowerShell execution policy in the Windows Registry to bypass signing requirements for script execution. This rule specifically looks for modifications to the 'ExecutionPolicy' registry values under PowerShell-related paths, setting them to 'Bypass' or 'Unrestricted'. It also filters out changes made by 'svchost' to reduce false positives.
Detects suspicious DNS queries to Monero mining pools
Page 383 of 680