SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations. This rule identifies when specific DLLs (coreclr.dll, facesdk.dll, HPCustPartUI.dll, libcef.dll, ZIPDLL.dll) are loaded from unusual or suspicious directories, such as Perflogs, Users\Public, Temporary Internet Files, Windows\Temp, or various user profile subdirectories like Favorites, Favourites, Contacts, and Pictures. This behavior is indicative of an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL from an unexpected path.
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). This database contains sensitive information used to sign SAML tokens. The rule specifically looks for connections to the '\MICROSOFT##WID\tsql\query' named pipe by processes other than known legitimate AD FS or Windows Internal Database components.
Detects the execution of PowerShell via the creation of a named pipe starting with 'PSHost'. This method can be used by adversaries to execute PowerShell commands or scripts, potentially bypassing traditional PowerShell logging mechanisms.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
This rule detects the execution of the PowerShell cmdlet 'Remove-ADGroupMember' with parameters '-Identity' and '-Members'. This cmdlet is used to remove one or more members from an Active Directory group. In the context of this rule, it specifically targets the removal of an account from the 'Domain Admins' group, which could be an adversary's attempt to inhibit access to critical accounts or to clean up their tracks after gaining access.
Detects the execution of non-standard or uncommon assistive technology applications via "AtBroker.exe". AtBroker.exe is a legitimate Windows binary that can be abused to proxy the execution of other programs, often for defense evasion or persistence. This rule specifically looks for instances where AtBroker.exe is used to start applications that are not part of the common, built-in Windows assistive technologies.
Detects the use of 'cdb.exe', a legitimate Windows debugger, to execute arbitrary processes or commands. This technique is often used by adversaries to bypass application whitelisting or execute malicious code through a trusted binary. The rule specifically looks for command-line arguments indicative of debugger script execution ('-c' or '-cf').
Detects potentially suspicious execution of 'csc.exe' (C# compiler) when spawned by common applications like Office programs, scripting engines (cscript.exe, wscript.exe, mshta.exe, powershell.exe), or from suspicious file system locations. This behavior can indicate payload delivery, compilation of malicious code on the fly, or defense evasion techniques.
Detects suspicious usage of curl.exe to download files to sensitive or temporary locations on Windows systems. This rule specifically looks for curl.exe processes that output downloaded content to common temporary directories, user-specific application data folders, public user folders, or the desktop, often with suspicious file extensions. This behavior is frequently associated with malware staging or initial access techniques.
Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a User Account Control (UAC) bypass attempt. The rule specifically filters out legitimate child processes like 'mmc.exe' and 'WerFault.exe' to reduce false positives.
Page 484 of 680