SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a potentially suspicious execution where a parent process located in the "\Users\Public" folder executes a child process that is a common shell or scripting binary, indicated by its image name or command line arguments. This behavior is often associated with malware attempting to hide in a publicly accessible directory and then execute further malicious commands.
Detects a process spawned by the terminal service server process (termsvcs), which could indicate an exploitation attempt of CVE-2019-0708, commonly known as BlueKeep. The rule specifically looks for processes where the parent command line contains both 'svchost.exe' and 'termsvcs', while filtering out legitimate processes like rdpclip.exe, csrss.exe, wininit.exe, and winlogon.exe.
Detects suspicious processes, including various shells and utilities, spawned by the WinRM host process (wsmprovhost.exe). This activity can indicate an adversary using WinRM for remote execution, potentially for initial access, persistence, or privilege escalation.
Detects the modification of the PortProxy registry key, which is used for port forwarding. This can indicate an adversary setting up a proxy for lateral movement or command and control.
This rule detects modifications to registry keys that enable the Dynamic Data Exchange (DDE) protocol in Microsoft Word or Excel. Specifically, it looks for changes to 'AllowDDE' in Word or 'DisableDDEServerLaunch'/'DisableDDEServerLookup' in Excel to a value that enables DDE. Adversaries may enable DDE to execute arbitrary commands, often as part of phishing campaigns or through embedded files, to bypass macro-based defenses.
Detects process executions that exhibit characteristics commonly associated with Emotet malware, specifically focusing on obfuscated PowerShell command line arguments. The rule looks for specific base64 encoded strings and patterns often used by Emotet for defense evasion and execution.
Detects process executions characteristic of Formbook malware. Specifically, it looks for processes originating from System32 or SysWOW64 directories with an executable extension, that then execute a command line containing '/c', 'del', and paths within 'C:\Users\<user>\AppData\Local\Temp\' or 'C:\Users\<user>\Desktop\'. It also covers a variant using '/C' and 'type nul >' for deletion on the Desktop. The rule aims to avoid false positives by excluding parent processes with command line parameters, suggesting an injection scenario where the parent process itself doesn't have complex command line arguments.
Detects exploitation of the DNS RCE vulnerability (CVE-2020-1350) by monitoring for suspicious sub-processes spawned by the `dns.exe` service. This rule specifically looks for processes created by `dns.exe` that are not common or expected system processes, indicating potential post-exploitation activity after successful exploitation of the vulnerability.
Detects access attempts to the SUPERNOVA webshell, specifically looking for requests to 'logoimagehandler.ashx' with 'clazz' in the query string, or requests to 'logoimagehandler.ashx' resulting in a 500 HTTP status code. This activity is indicative of an adversary interacting with a deployed webshell.
Detects a specific command line argument sequence used by the SNAKE malware during its installation phase, as detailed in a CISA report. The rule looks for a process creation event where the command line contains two specific arguments: the first is a 64-character hexadecimal string (assumed to be a SHA-256 hash), and the second is at least a 16-character hexadecimal string (assumed to be part of an AES initialization vector).
Page 441 of 680