SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects indicators of exploitation related to PaperCut MF/NG vulnerabilities. Specifically, it looks for command-line patterns associated with downloading and executing a malicious MSI installer. The first pattern identifies PowerShell commands using 'Invoke-WebRequest' to download 'setup.msi' with hidden window and no profile. The second pattern identifies 'msiexec' being used to install 'setup.msi' with a specific 'IntegratorLogin' parameter, which is a known indicator of the PaperCut exploitation.
Detects the execution of the 'echo' command with the '%userdomain%' environment variable. This activity can be used by adversaries to enumerate the domain a user is associated with, which is a common discovery technique.
Detects the deletion of the "Zone.Identifier" Alternate Data Stream (ADS). Attackers can leverage this to bypass security restrictions that make use of the ADS, such as those in Microsoft Office applications. By removing this identifier, a file downloaded from the internet might be treated as a local file, potentially allowing macros or other active content to run without security warnings.
Detects the creation of a scheduled task by monitoring file creation events in the standard Windows scheduled task directories. This rule specifically looks for new files being written to ':\Windows\System32\Tasks\', ':\Windows\SysWOW64\Tasks\', and ':\Windows\Tasks\', which are common locations for scheduled task definitions.
Detects a network connection initiated by the "hh.exe" process to HTTP destination ports (80 or 443). This activity could indicate the execution or download of remotely hosted Compiled HTML (.chm) files, which can be abused by adversaries to conceal and execute malicious code. This technique is often used for defense evasion and can bypass application controls.
This rule detects the use of PowerShell's `Remove-Item` cmdlet or its aliases (`del`, `erase`, `rd`, `ri`, `rm`, `rmdir`) with the `-Path` parameter within a PowerShell script block. This activity is indicative of file or folder deletion, which can be used by adversaries for defense evasion or to remove traces of their activity.
Detects the execution of 'curl.exe' on Windows systems. This activity can indicate an attempt to download files from a remote location, make web requests to external servers, or potentially be used for command and control communication. Adversaries often use tools like curl for ingress tool transfer or to retrieve additional malicious payloads.
Detects the execution of 'curl.exe' when a custom User-Agent string is specified using either the '-A' or '--user-agent' command-line options. This behavior can be indicative of an adversary attempting to mimic legitimate web traffic while using a non-standard User-Agent to evade detection or to identify themselves to a C2 server.
Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications. Adversaries may use Diskshadow.exe to proxy execution of other commands or to inhibit system recovery by deleting shadow copies.
This rule detects the execution of rundll32.exe when it attempts to call a DLL export by its ordinal number. This technique is often used by malware for defense evasion, as it can bypass security tools that might not monitor rundll32.exe or its specific command-line arguments. The rule specifically looks for command-line patterns like ',#' or '.dll #' which indicate an ordinal call. It includes filters to reduce false positives from legitimate Windows components like EDGEHTML.dll or Visual Studio build processes.
Page 499 of 680