SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of a child process by the PSEXESVC.exe service, specifically when that child process runs with LOCAL_SYSTEM privileges. This indicates that a command was remotely initiated on the system with the highest possible privileges, rather than the privileges of the initiating user account. This behavior is characteristic of PsExec being used for remote execution with SYSTEM-level access.
Detects the creation of new processes using the 'wmic.exe' utility with the 'process call create' command-line arguments. This is a common technique used by adversaries for execution.
This rule detects suspicious execution of WMIC (Windows Management Instrumentation Command-line) by Microsoft Office applications. Adversaries often leverage Office applications as an initial execution vector and then use LOLBINs (Living Off the Land Binaries) like WMIC to proxy execution, break parent-child process chains, and evade detection. Specifically, this rule looks for Office processes (Word, Excel, PowerPoint, etc.) spawning `wmic.exe` with command-line arguments indicative of process creation and execution of other suspicious LOLBINs such as `regsvr32`, `rundll32`, `msiexec`, `mshta`, `verclsid`, `wscript`, or `cscript`.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", "bitsadmin", "certutil", "cscript", "wscript", "mshta", or commands involving 'cmd.exe' or 'powershell', or paths like 'Users\Public', 'Windows\Temp', 'AppData\Local', and common temporary/program data environment variables. This indicates potential malicious execution or persistence.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring changes to specific registry keys. This includes scenarios such as enabling RDP connections, allowing multiple RDP sessions per user, or disabling Network-Level Authentication (NLA) by setting the relevant registry values to '0'. Such modifications can facilitate unauthorized access or RDP hijacking.
Detects tampering of RDP Terminal Service/Server sensitive settings. This includes modifications to allow unsolicited remote assistance, disable security settings, or enable RDP via specific registry keys. It also covers changes related to RDP hijacking via the 'ServiceDll' key and the 'Shadow' RDP technique.
This rule detects the creation of any Portable Executable (PE) file that is monitored by the Sysmon configuration. It specifically triggers on Sysmon Event ID 29, which corresponds to 'FileExecutableDetected'. This event indicates that Sysmon has identified and logged the creation of an executable file based on its internal configuration.
Detects Microsoft Word (WINWORD.EXE) starting the uncommon sub-process FLTLDR.exe, which is indicative of exploitation attempts for vulnerabilities like CVE-2017-0261 and CVE-2017-0262. This behavior suggests a malicious document is attempting to execute arbitrary code.
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
Detects potential process and execution activity related to the APT10 Cloud Hopper operation. Specifically, it looks for `cscript.exe` executing VBScripts with a `/shell` argument and `csvde` commands attempting to export data to a log file in `C:\windows\web\`.
Page 486 of 680