SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of a suspicious Alternate Data Stream (ADS) file, specifically a ':Zone.Identifier' stream, by processes other than common web browsers. The ':Zone.Identifier' ADS is used by Windows to mark files downloaded from the internet, indicating their origin and often triggering security warnings. This rule looks for the creation of this ADS with a 'ZoneId=3' (indicating an internet origin) on executable or document file types. By filtering out known browser processes, the rule aims to identify instances where other applications or scripts might be creating these ADS files, potentially as a defense evasion technique to bypass security warnings or to masquerade malicious files.
This rule detects when a driver is loaded from a temporary directory. Adversaries may load malicious drivers from temporary locations as part of persistence, privilege escalation, or defense evasion techniques. Loading drivers from temporary directories is often an unusual behavior for legitimate system operations and can indicate suspicious activity.
This rule detects the creation of new text files (.txt) within a user's Desktop directory by the 'cmd.exe' process. This behavior is often associated with ransomware dropping ransom notes or other instructional files after encrypting data.
Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.
Detects the execution of 'curl.exe' with command-line flags that disable security checks for proxy or DNS over HTTPS (DoH) connections. This behavior can indicate an attempt to bypass security controls or establish covert communication channels.
Detects the execution of the "driverquery" utility, which can be used by adversaries to perform reconnaissance on installed drivers. This rule specifically looks for 'driverquery.exe' or 'drvqry.exe' as the image or original filename.
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts.
This rule detects the execution of `netsh.exe` commands that modify the Windows Firewall to whitelist a program. Specifically, it looks for `netsh.exe` being executed with arguments to 'add allowedprogram' or 'add rule' with 'action=allow' and 'program=' where the program path is located in suspicious directories such as Recycle Bin, System Volume Information, Temp folders, or various Windows system subdirectories that are not typical locations for legitimate applications requiring firewall exceptions.
This rule detects the execution of the 'netsh.exe' utility specifically when it is used to modify existing Windows Advanced Firewall rules. The detection logic looks for 'netsh.exe' being executed with the 'advfirewall' and 'set' options in the command line, indicating an attempt to change properties of an already defined firewall rule. This activity could be indicative of an adversary attempting to bypass network controls to facilitate C2 communications, lateral movement, or data exfiltration.
This rule detects the execution of the 'rar.exe' utility with command-line arguments indicating the creation of an archive that is either password-protected ('-hp') or uses a specific compression level ('-m'). This combination of parameters is often associated with malicious activities, such as data exfiltration or staging, where adversaries compress and password-protect data before moving it off a compromised system.
Page 452 of 680