SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of a named pipe using `cmd.exe` or `powershell.exe` by looking for specific command-line arguments. The presence of `echo`, `>` and `\\.\pipe\` in the command line indicates an attempt to create or interact with a named pipe. This activity can be associated with privilege escalation techniques, where an attacker might use named pipes for inter-process communication to elevate privileges.
This rule detects the creation of the PSEXESVC.exe process, which is the service component of PsExec. The presence and execution of this service indicate that PsExec was used to remotely execute commands or applications on the system.
This rule detects attempts to uninstall the Crowdstrike Falcon sensor by monitoring process creation events for specific command-line arguments. It looks for the execution of 'WindowsSensor.exe' with the '/uninstall' and '/quiet' flags, which are indicative of a silent uninstallation process. Adversaries often disable security tools like EDRs to evade detection of their malicious activities.
Detects the creation of a PowerShell process (powershell.exe or pwsh.exe) as a child of WmiPrvSE.exe. This activity is indicative of potential lateral movement or execution via Windows Management Instrumentation (WMI), where WMI is used to spawn a PowerShell process on a system.
Detects the modification of the 'Debugger' value within the Image File Execution Options (IFEO) registry key for various Windows accessibility tools. This technique is commonly used by adversaries to establish persistence and privilege escalation by replacing legitimate accessibility tools (like sethc.exe or utilman.exe) with a malicious executable that launches with SYSTEM privileges from the login screen.
This rule detects when the Windows Defender operational event log is disabled by setting its 'Enabled' registry value to 0. This activity has been observed in relation to Lockbit 3.0 ransomware infections as a defense evasion technique.
This rule detects the execution of ZxShell malware by monitoring process creation events. Specifically, it looks for 'rundll32.exe' being executed with command-line arguments containing either 'zxFunction' or 'RemoteDiskXXXXX'. These strings are known indicators of ZxShell's operational behavior when launched via rundll32.
Detects file indicators associated with a 2018 phishing campaign attributed to APT29 (Cozy Bear), as reported by Mandiant. The rule specifically looks for the creation or modification of files named 'ds7002.lnk', 'ds7002.pdf', or 'ds7002.zip'.
Detects activity associated with the Tropic Trooper campaign from November 2018, specifically looking for a distinct command-line string used by the threat actor. This rule targets a specific pattern in process command lines that indicates the execution of malicious code or scripts by Tropic Trooper, an actor known for targeting organizations in the energy and food and beverage sectors in Asia.
Detects the execution of a process with command-line arguments containing '-export dll_u' or ending with ',dll_u' or ' dll_u'. This specific export function name 'dll_u' is known to be used by tools associated with the Equation Group, indicating potential malicious activity related to their implants or frameworks.
Page 475 of 680