SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,547 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of common macOS command-line utilities used for enumerating local network configuration and firewall settings. This includes tools like 'arp', 'ifconfig', 'netstat', 'networksetup', and 'socketfilterfw', as well as 'defaults' when querying specific firewall preferences.
Detects the execution of Microsoft Workflow Compiler (Microsoft.Workflow.Compiler.exe), which can be abused to execute arbitrary unsigned code. This utility is part of the .NET Framework and can compile and execute workflow definition files. Adversaries may leverage this for defense evasion and execution by proxying malicious code through a trusted, signed binary.
Detects the 'sdiagnhost.exe' process launching suspicious child processes, which has been observed in exploits like Follina (CVE-2022-30190). The rule specifically looks for sdiagnhost.exe as a parent process and a list of common Living Off The Land Binaries (LOLBins) or other suspicious executables as child processes. It includes filters to reduce false positives related to common command-line arguments for cmd.exe and powershell.exe.
This rule detects file activity indicative of potential exploitation of the MOVEit Transfer CVE-2023-34362 vulnerability. It specifically looks for the creation or modification of suspicious file types (like .7z, .bat, .dll, .exe, .ps1, .rar, .vbe, .vbs, .zip) within the MOVEit Transfer webroot directory. Additionally, it identifies the presence of known malicious files such as `_human2.aspx` or `human2.aspx` and their shortcut files (`.lnk`) within the same directory. The rule also includes a selection for newly compiled ASP.NET DLLs within the temporary ASP.NET files directory, created around the time the vulnerability was actively exploited (March-June 2023), which could indicate the deployment of web shells or other malicious code.
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility with the "/extract" argument. This method was historically used by malware to extract cabinet files, and while it may still function on older Windows versions, it is generally not a supported or common legitimate use case in modern systems.
Detects the execution of "Extexport.exe", a utility that is part of the Internet Explorer browser. This utility can be abused for DLL sideloading, specifically by loading "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll" if a folder is provided in the command line, or arbitrary DLLs if specific flags are used. This behavior is associated with malware like Astaroth and Guildma.
This rule detects when a single rule or all rules have been deleted from the Windows Defender Firewall exception list. This activity can indicate an adversary attempting to impair defenses by removing firewall restrictions to facilitate command and control, lateral movement, or data exfiltration.
Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. This vulnerability affects 7-Zip version 21.07 and earlier on Windows, allowing privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The rule specifically looks for child processes like cmd.exe, powershell.exe, or pwsh.exe being spawned under the 7zFM.exe process, excluding common command line arguments or file extensions that might indicate legitimate usage.
Detects attempts to bypass AMSI (Antimalware Scan Interface) using .NET reflection. This technique involves manipulating the 'amsiInitFailed' field within 'System.Management.Automation.AmsiUtils' to disable AMSI scanning, often seen in PowerShell scripts to evade detection.
This rule detects when 'sigverif.exe' spawns child processes that are not 'WerFault.exe'. 'sigverif.exe' is a legitimate Windows binary used for verifying file signatures. However, it can be abused as a Living Off the Land Binary (LOLBIN) to proxy execution of other malicious processes, thereby bypassing application whitelisting or other security controls. The rule specifically filters out 'WerFault.exe' as a common and legitimate child process of 'sigverif.exe' to reduce false positives.
Page 398 of 680