SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,547 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of Xwizard.EXE with the "RunWizard" flag and a GUID-like argument, which indicates an attempt to abuse this utility to run custom COM objects created in the registry. This technique is often used for defense evasion.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could leverage this to run malicious Python code within Excel without user notification.
Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths like PerfLogs, Users\Public, Windows\Temp, or Appdata\Local\Temp. This activity can be indicative of malware unpacking or staging.
Detects the execution of "AccCheckConsole.exe" with command-line arguments indicative of its use for UI accessibility checking, which can be abused to load malicious DLLs. This utility allows providing a custom DLL containing a "verification routine" via the command line, enabling an attacker to inject and execute arbitrary code within the context of the legitimate `AccCheckConsole` process.
Detects the execution of 'Advanced Port Scanner' based on its image name, original file name, description, or specific command-line arguments. This tool is often used for network reconnaissance.
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities. This rule specifically looks for `schtasks.exe` being used with the `/Change`, `/TN`, and `/disable` arguments, targeting important system tasks like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate.
Detects a network connection initiated by programs or processes running from suspicious or uncommon file system locations. This often indicates malware execution or persistence from areas not typically used by legitimate applications for network communication.
Detects command execution via ScreenConnect RMM
Detects file being transferred via ScreenConnect RMM
Page 399 of 680