SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,542 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of a Microsoft Office application (Excel, PowerPoint, Word) that attempts to open a document located in a trusted Microsoft Office location. Attackers often leverage this technique to bypass macro security warnings and execute malicious code, as documents in trusted locations may not trigger security prompts. The rule specifically looks for parent processes like explorer.exe or dopus.exe launching these Office applications with command-line arguments pointing to documents within known trusted paths such as AppData\Roaming\Microsoft\Templates or Microsoft Office\root\Templates. It filters out common template file extensions (.dotx, .xltx, .potx) to reduce false positives.
This rule detects the execution of a binary that has been renamed from its original 'CURL.exe' name. It identifies this by checking the 'OriginalFileName' and 'Description' fields within the executable's PE metadata. The rule specifically triggers if these fields indicate 'curl.exe' or 'The curl executable', but the actual image path does not contain '\curl', suggesting an attempt to evade detection by renaming the legitimate curl utility.
Detects the creation of a named pipe with the pattern '\coerced\' which is indicative of the hack tool CoercedPotato. This tool is used for privilege escalation by coercing authentication from a target system.
This rule detects PowerShell scripts that attempt to discover security software installed on a system. Specifically, it looks for the use of 'Get-Process' (or its alias 'gps') piped to 'Where-Object' (or its alias '?') to filter processes based on keywords commonly associated with security products such as 'avira', 'carbonblack', 'cylance', 'defender', 'kaspersky', 'malware', 'sentinel', 'symantec', and 'virus'. The filtering can be applied to process properties like Company, Description, Name, Path, or Product. This activity is indicative of an adversary attempting to enumerate defensive tools present on the system.
This rule detects the use of 'curl.exe' to download files from an IP address directly specified in the command line. It specifically looks for curl.exe execution, a command line containing an IP address pattern, the 'http' protocol, and common download flags such as '-O', '--remote-name', or '--output'. This activity is often associated with adversaries transferring tools or malware onto a compromised system.
Detects command line arguments that include '::$index_allocation', which is a technique used to create hidden directories or files within the NTFS file system. This method can prevent standard tools like 'explorer.exe' or 'powershell.exe' from accessing or listing these hidden artifacts, serving as a defense evasion tactic.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could disable these warnings to run malicious Python code within spreadsheets without user notification, leveraging the new Microsoft Excel feature that allows Python execution.
Detects the creation of files that look like exports of the local SAM (Security Account Manager)
Detects the execution of Windows binaries from within a Windows Subsystem for Linux (WSL) instance. This technique can be used by adversaries to masquerade parent-child process relationships, making it harder to detect malicious activity.
Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
Page 397 of 680