SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects suspicious child processes spawned by the VMware Tools daemon (vmtoolsd.exe). Adversaries may leverage vmtoolsd.exe to establish persistence by executing various scripting and command-line interpreters such as cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. The rule specifically filters out legitimate VMware Tools scripts related to power management to reduce false positives.
Detects modifications to the Windows Registry that disable the System Restore functionality. This is achieved by setting specific registry values ('DisableConfig' or 'DisableSR') to '1' (DWORD 0x00000001) within the System Restore related registry paths.
Detects when an attacker attempts to add a new network provider by modifying the registry, which can be used to dump clear text credentials. This technique is similar to how tools like NPPSpy operate by registering a malicious network provider DLL to intercept credentials during the authentication process.
Detects the execution of javaw.exe from an AppData folder, which is a known behavior of Adwind RAT (also known as jRAT). Additionally, it detects the execution of cscript.exe with specific command-line arguments related to 'Retrive.vbs', which could indicate further malicious activity or a different variant/stage of the attack.
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
Detects various process execution behaviors associated with the Lazarus Group, including attempts to dump SAM registry hive, network connection enumeration using netstat, network share discovery patterns, persistence mechanisms involving common program data directories, and rundll32 execution with specific file extensions.
Detects potential beaconing activity from the 3CXDesktopApp to known malicious domains associated with the 3CX supply chain compromise. This rule identifies outbound network connections initiated by the 3CXDesktopApp.exe process to a specific list of suspicious hostnames, indicating potential command and control communication.
Detects potential command and control (C2) beaconing activity to domains identified as being used in the 'Operation Triangulation' attacks, which targeted iOS devices. These domains were revealed by Kaspersky and the FSB.
This rule detects specific command-line executions associated with Mustang Panda's activity, particularly targeting the Australian government, as reported by Lab52. The rule looks for two distinct patterns: the copying of 'SolidPDFCreator.dll' to a specific public user directory, and the modification of the Windows Registry 'Run' key to establish persistence for 'SolidPDF' using the same directory. These actions indicate an attempt to install and persist malicious software.
Detects the creation of files with a specific naming pattern '/mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}.tar.gz' which has been observed to be used by the threat actor UNC4841 for staging and exfiltration of email-related data.
Page 432 of 680