SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects remote access to the Local Security Authority Subsystem Service (LSASS) process via Windows Remote Management (WinRM). This activity is highly indicative of credential dumping attempts, often performed by tools like Mimikatz, to extract sensitive authentication material from memory. The rule specifically looks for process access events where the target process is 'lsass.exe' and the source process initiating the access is 'wsmprovhost.exe', which is associated with WinRM. It also filters out common benign access patterns (0x80000000 GrantedAccess) to reduce false positives.
Detects the execution of 'curl.exe' with the '-c' flag or '--cookie-jar' option to save cookie data. This activity can be indicative of an attacker attempting to hijack sessions by extracting authentication cookies.
Detects the execution of 'find.exe' or 'findstr.exe' where the command line arguments include a '.lnk' file. This behavior has been observed in attacks, such as the HHS redirect attack, where adversaries use these legitimate Windows utilities to indirectly execute malicious shortcut files.
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords or configuration details that may contain sensitive information. This activity indicates an attempt to dump credentials from IIS.
This rule detects unusual parent or child processes associated with 'ImagingDevices.exe' (Windows Contacts). Specifically, it looks for 'ImagingDevices.exe' being spawned by 'WmiPrvSE.exe', 'svchost.exe', or 'dllhost.exe', or for 'ImagingDevices.exe' spawning any child process. This activity has been observed in connection with Bumblebee malware operations, where adversaries might abuse legitimate processes for execution or defense evasion.
Detects when the Microsoft Management Console (MMC) spawns a Windows shell or command-line executable. This behavior can indicate an adversary abusing the MMC2.0 Application COM object for remote code execution or lateral movement. The rule specifically looks for mmc.exe as the parent process of common shell executables like cmd.exe, powershell.exe, wscript.exe, cscript.exe, reg.exe, regsvr32.exe, or other scripting/command interpreters.
Detects the execution of the Chisel tunneling tool by analyzing command-line arguments. Chisel is a fast TCP/UDP tunnel, secured by SSH, and can be used for various tunneling purposes, including creating SOCKS5 proxies or reverse tunnels. This rule specifically looks for the 'chisel.exe' image name combined with common client/server commands and tunneling parameters like '-socks5', '-reverse', or '-tls-skip-verify'.
Detects the execution of the Rclone utility, which is often used by ransomware strains like REvil, Conti, and FiveHands for data exfiltration to cloud storage services. The rule looks for specific command-line arguments and image names associated with Rclone.
Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.
This rule detects the execution of the `systeminfo.exe` command, which is used to retrieve detailed system information. Adversaries often use this command during the discovery phase to gather information about the compromised system's operating system, hardware, and installed software. This information can help them understand the environment and plan subsequent actions.
Page 446 of 680