SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,564 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of "vim" and its sibling commands (rvim, vimdiff) to execute a shell or proxy commands. This behavior can be indicative of privilege escalation, unauthorized command execution, or attempts to break out of restricted environments by leveraging the capabilities of these text editors to run arbitrary commands or scripts (e.g., via :!/, :lua, :py, or direct shell calls).
Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles. The rule specifically looks for child processes with suspicious image names (e.g., calc.exe, regsvr32.exe, rundll32.exe, cscript.exe, wscript.exe), PowerShell or command prompt processes executing suspicious commands (e.g., Invoke-Expressions, IEX, Invoke-Command, DownloadString, rundll32, regsvr32, wscript, cscript), or child processes launched from suspicious paths (e.g., C:\Users\Public\, C:\Windows\Temp\, C:\Temp\).
Detects potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
This rule detects process creation events where the command line contains a specific, unique string ' uTYNkfKxHiZrx3KJ'. This string is identified as an indicator of compromise associated with the Diamond Sleet APT group, also known as Lazarus Group. The rule aims to identify execution of malicious payloads or commands used by this threat actor.
This rule detects the installation of Visual Studio Code Tunnel (code-tunnel) as a Windows service. Adversaries may use legitimate tools like VS Code Tunnel for command and control (C2) to establish persistent communication channels that blend in with normal network traffic, making detection more difficult. The detection logic specifically looks for command-line arguments indicative of service installation, including 'tunnel', 'service', 'internal-run', and 'tunnel-service.log'.
Detects when files are transferred using the ScreenConnect Remote Monitoring and Management (RMM) tool. This activity can indicate an adversary using legitimate tools for data exfiltration or staging.
Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, a common technique for credential access.
This rule detects DNS queries to specific domains identified as indicators of compromise (IOCs) associated with the Diamond Sleet APT group. The domains '3dkit.org', 'dersmarketim.com', 'galerielamy.com', and 'olidhealth.com' are known to be used by this threat actor for command and control (C2) communications. Monitoring for these specific DNS queries can help identify systems potentially compromised by Diamond Sleet.
Detects the creation of a scheduled task in the Windows Registry that is specifically associated with the Diamond Sleet APT group. This activity is linked to their exploitation of the TeamCity CVE-2023-42793 vulnerability, where they create a scheduled task named 'Windows TeamCity Settings User Interface' to establish persistence or execute malicious code.
Detects the creation of hidden files or folders by appending the "::$index_allocation" stream to their names. This technique can be used by adversaries to prevent standard tools like Windows Explorer or PowerShell from accessing or listing these hidden artifacts, thereby evading detection and hindering forensic analysis.
Page 394 of 680