SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,534 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of a scheduled task named '\Windows TeamCity Settings User Interface' with a specific content string 'uTYNkfKxHiZrx3KJ'. This activity has been linked to the Diamond Sleet APT group exploiting the TeamCity CVE-2023-42793 vulnerability for execution, persistence, and privilege escalation.
Detects the creation of temporary files by the ScreenConnect remote monitoring and management (RMM) tool in a specific user document directory. This behavior is associated with ScreenConnect's feature to remotely execute binaries on a target machine, where these binaries are first dropped to the specified temporary location before execution.
Detects execution of regsvr32 with the silent flag and no other flags on a DLL located in an uncommon or potentially suspicious location. When Regsvr32 is called in such a way, it implicitly calls the DLL export function 'DllRegisterServer'.
Detects when the DLL export function 'DllRegisterServer' is called in the commandline by Rundll32 explicitly where the DLL is located in a non-standard path. This behavior is often abused by adversaries to execute malicious DLLs for defense evasion.
This rule detects the use of the Deployment Image Servicing and Management (DISM) tool, specifically 'Dism.exe' or 'DismHost.exe', with command-line arguments indicating an attempt to disable features or remove packages from a running Windows operating system ('/Online' and '/Disable-Feature'). This activity can be indicative of an adversary trying to impair defenses by disabling security features or removing security-related components.
Detects the modification of the 'AllowAnonymousCallback' registry value to '1' (0x00000001) within the WMI CIMOM path. This registry setting enables remote connections between computers that do not have a trust relationship, which can be abused by attackers for lateral movement or remote execution without proper authentication. This modification can indicate an attempt to weaken security controls related to WMI remote access.
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
This rule detects attempts to use obfuscated or encoded IP addresses (e.g., hexadecimal, octal, or URL-encoded formats) within command-line arguments of `ping.exe` or `arp.exe`. This technique can be used by adversaries to evade simple string-based detections or to obscure their network communication targets.
Detects when the CertOC.exe utility is used to download a file from an IP address-based URL. This behavior is suspicious as CertOC.exe is a legitimate Windows binary that can be abused for ingress tool transfer, and downloading from an IP address directly often bypasses DNS-based security controls and can indicate malicious activity.
Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.
Page 396 of 680