SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the built-in Windows utility bitsadmin.exe to download files. This utility is often abused by adversaries for ingress tool transfer, as it can bypass certain network restrictions and is a living-off-the-land binary (LOLBIN). The rule specifically looks for the execution of bitsadmin.exe with command-line arguments indicative of file transfer operations, such as '/transfer', '/create', '/addfile', and the presence of 'http' to signify a URL download.
Detects the execution of "DirLister.exe", a utility used by the BlackCat ransomware group to enumerate files and directories on a compromised system. This tool helps adversaries quickly map out the file system for further malicious activities like data exfiltration or encryption.
Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.
Detects the use of MSTSC (Microsoft Terminal Services Client) with specific command-line arguments ('noconsentprompt' and 'shadow:') which indicates an attempt to perform RDP session shadowing without user consent. This technique can be used for RDP session hijacking.
Detects modifications to Group Policy settings using `reg.exe` by looking for specific registry paths and keys commonly associated with Group Policy configurations. Malicious GPO modifications can be used to implement various other malicious behaviors, including privilege escalation and defense evasion.
This rule detects an unusual process creation event where 'rundll32.exe' spawns 'explorer.exe' as a child process. This behavior is uncommon and has been observed in malware such as Gamarue, which uses this method to launch 'explorer.exe' in an atypical manner. The rule specifically filters out legitimate instances where 'rundll32.exe' might launch 'explorer.exe' via 'shell32.dll,Control_RunDLL', aiming to reduce false positives.
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments indicating the use of 'davclnt.dll,DavSetCookie' and a remote IP address. This activity is suspicious as it can be an indicator of data exfiltration, execution of code hosted on a WebDAV server, or exploitation related to CVE-2023-23397, particularly for NTLM hash theft.
Detects the execution of 'setspn.exe' with the query flag ('-q' or '/q'), which is commonly used by attackers to enumerate Service Principal Names (SPNs) as a precursor to Kerberoasting attacks. This activity can help identify potential attempts to discover service accounts with weak passwords that can be cracked offline.
This rule detects the execution of the 'shutdown.exe' command-line utility with parameters '/r' (reboot) or '/s' (shutdown). This activity can be indicative of an adversary attempting to impact system availability by shutting down or rebooting a Windows system.
Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Page 474 of 680