SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious execution of Microsoft HTML Help (hh.exe) when it is launched from unusual or temporary directories, or with command-line arguments indicating potential malicious activity. Adversaries often abuse hh.exe to execute malicious code embedded within Compiled HTML (CHM) files, leveraging it as a living-off-the-land binary to bypass defenses and execute payloads. The rule specifically looks for hh.exe being executed from common temporary or user download paths, which are frequently used for initial access or staging.
Detects the execution of the PurpleSharp adversary simulation tool by looking for specific image paths, original filenames, or command-line arguments associated with the tool. This rule helps identify when an adversary simulation or red team exercise involving PurpleSharp is being conducted on a system.
Detects suspicious child processes spawned by the "Manage Engine ServiceDesk Plus" Java web service. This often indicates successful exploitation of the application, potentially related to vulnerabilities like CVE-2022-47966. The rule looks for the execution of various system utilities and scripting interpreters commonly used by attackers for reconnaissance, privilege escalation, defense evasion, or establishing command and control.
Detects the execution of the "logman" utility to disable or delete Windows trace sessions, which can be used by adversaries for defense evasion by tampering with logging mechanisms like Sysmon or other kernel loggers.
This rule detects suspicious PowerShell process creations that include base64 encoded commands. It looks for PowerShell or pwsh executables being launched with the '-e', '-en', or '-enc' command-line arguments, combined with specific base64 encoded strings commonly associated with malicious activity (e.g., ' JAB', ' SUVYI', ' SQBFAFgA', ' aQBlAHgA', ' aWV4I', ' IAA', ' IAB', ' UwB', ' cwB'). It also includes a standalone detection for '.exe -ENCOD ' and ' BA^J e-' (reversed). This pattern is often used by malware like Emotet to obfuscate their command-and-control instructions or payloads.
Detects the execution of PowerShell commands that contain reversed strings, a common obfuscation technique used by attackers to evade detection. The rule specifically looks for PowerShell or pwsh.exe processes where the command line contains reversed versions of common PowerShell keywords or commands, while excluding commands that use standard encoded command parameters to reduce false positives.
Detects suspicious patterns in PowerShell command lines that indicate the use of `Invoke-Expression` (IEX) for potentially malicious code execution. This rule looks for various obfuscated or unusual ways IEX might be invoked, often in conjunction with base64 encoded strings, to execute arbitrary commands or scripts.
Detects the presence of a potentially XOR encoded PowerShell command by looking for the 'bxor' operator in conjunction with common PowerShell command elements like 'ForEach', 'for', '-join', and '[char]'. This pattern is often used by adversaries to obfuscate malicious scripts.
Detects the execution of DefenderCheck, a tool used to analyze Microsoft Defender signatures. This tool can be leveraged by adversaries to identify detection patterns and develop evasion techniques for their malware.
This rule detects the creation of potentially suspicious child processes by 'regsvr32.exe'. Regsvr32.exe is a legitimate Windows utility that can be abused by adversaries to proxy execution of malicious code, often referred to as 'Squiblydoo'. The rule specifically looks for regsvr32.exe spawning common Windows utilities or scripting engines like calc.exe, powershell.exe, cmd.exe (implied by net.exe, net1.exe, reg.exe, schtasks.exe), mshta.exe, cscript.exe, and wscript.exe. This behavior is often indicative of defense evasion or execution techniques where regsvr32.exe is used to bypass application whitelisting or security controls.
Page 485 of 680