SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,601 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of "whoami.exe" with the "/FO CSV" flag to choose CSV as output format or with redirection options (e.g., `whoami > file.txt`) to export the results to a file for later use. This activity is often observed in post-exploitation discovery phases by adversaries to gather information about the current user.
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
Detects whether a process is created from an image path that does not have a standard executable file extension (e.g., .exe, .com, .bin). This behavior can indicate advanced evasion techniques like process ghosting or other unorthodox methods to launch processes, where an executable might be disguised or loaded without a typical extension. The rule includes various filters to reduce false positives from legitimate system processes, temporary files, installer components, and specific third-party applications.
Detects the usage of `findstr.exe` in combination with keywords like "Everyone" or "BUILTIN" to identify potentially misconfigured file or folder permissions. This activity is often seen during reconnaissance phases by adversaries looking for privilege escalation opportunities.
Detects PowerShell commands that decrypt an ".LNK" file to drop the next stage of the malware. The rule specifically looks for PowerShell execution combined with command-line arguments indicative of file system enumeration (Get-ChildItem, dir, gci, ls), file content retrieval (Get-Content, gc, cat, type, ReadAllBytes), and specific patterns involving ".lnk" files, recursion, skipping bytes, expanding properties, and writing all bytes, suggesting decryption and dropping of subsequent malware stages.
This rule detects potentially suspicious command-line arguments used with Electron-based applications such as Microsoft Teams, Discord, Slack, Microsoft Edge, and VS Code. The presence of specific command-line switches like '--browser-subprocess-path', '--gpu-launcher', '--renderer-cmd-prefix', or '--utility-cmd-prefix' in conjunction with these applications could indicate an attempt to abuse these signed binaries for proxy execution of malicious code, potentially bypassing security controls.
This rule detects suspicious child processes spawned by Excel.exe, which can indicate lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object. Specifically, it looks for child processes with original filenames or image paths ending in 'foxprow.exe', 'schdplus.exe', or 'winproj.exe'. This behavior is associated with DCOM abuse for remote code execution.
Detects the usage of "msedge_proxy.exe" to download arbitrary files by looking for its execution with command-line arguments containing 'http://' or 'https://'. This behavior can be abused for defense evasion and execution.
Detects the execution of the 'whoami.exe' command by highly privileged accounts such as 'AUTHORITY\SYSTEM', 'NT AUTHORITY\SYSTEM', or 'TrustedInstaller'. This activity can indicate an attacker performing discovery after achieving privilege escalation, as these accounts are often targeted for abuse.
This rule detects the usage of the Windows Package Manager (winget.exe) to add new package sources, specifically looking for command-line arguments that include 'source add' and an IP address as the source. This could indicate an attempt to introduce a malicious or untrusted package repository.
Page 389 of 680