SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of Microsoft's bash launcher (bash.exe) with the "-c" flag. This technique can be used by adversaries to bypass defenses and execute Linux or Windows-based binaries indirectly via bash, leveraging the Windows Subsystem for Linux (WSL) environment.
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen. This rule specifically looks for processes like cmd.exe or powershell.exe being launched by winlogon.exe, with command-line arguments indicating an attempt to leverage Windows accessibility features such as sethc.exe (Sticky Keys), utilman.exe (Utility Manager), osk.exe (On-Screen Keyboard), Magnify.exe, Narrator.exe, or DisplaySwitch.exe.
This rule detects the execution of 'csc.exe' (C# compiler) in suspicious file system locations. Attackers often use csc.exe to compile .NET code on the fly, enabling them to bypass traditional defenses and execute malicious code during later stages of an attack. The rule specifically looks for csc.exe execution where the command line arguments indicate compilation in temporary directories, user-specific folders like Public, AppData\Local\Temp, or other common user-writable locations that are not typically used for legitimate software compilation.
This rule detects the use of the 'dsacls.exe' utility to grant potentially over-permissive permissions on Active Directory objects. It specifically looks for the execution of 'dsacls.exe' with the '/G' flag, which is used to grant permissions, combined with common permission flags like 'GR' (Generic Read), 'GE' (Generic Execute), 'GW' (Generic Write), 'GA' (Generic All), 'WP' (Write Property), or 'WD' (Write DACL). This combination suggests an attempt to broaden access controls, which could be a legitimate administrative action or an adversary attempting to escalate privileges or maintain persistence.
Detects obfuscated PowerShell commands executed via `cmd.exe` using the VAR++ LAUNCHER technique. This method involves using `cmd.exe`'s `&&set` command to define variables that are then used in conjunction with string formatting (`-f` and `{0}` style placeholders) to construct and execute PowerShell commands, often involving `Invoke-Expression` and `DownloadString` for remote code execution.
Detects the execution of PowerShell with a specific flag sequence ('-NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc') that is characteristic of the Wmiexec script, often used for lateral movement and defense evasion.
Detects the execution of 'IEExec.exe' with command-line arguments containing 'http://' or 'https://', indicating an attempt to download and execute files from a remote web server. This utility is part of the .NET Framework and can be abused by adversaries for ingress tool transfer.
Detects the execution of "Ldifde.exe" with the import flag "-i" and a file specified by "-f". This can be abused to import data, potentially from remote HTTP sources, leading to arbitrary file downloads or data injection.
This rule detects the use of the legitimate Microsoft SQL Server utility `sqldumper.exe` to dump process memory. Specifically, it looks for `sqldumper.exe` being executed with command-line arguments that indicate an attempt to dump a process, such as '0x0110' or '0x01100:40'. This technique can be abused by attackers to dump sensitive processes like LSASS (Local Security Authority Subsystem Service) to extract credentials.
Detects the usage of the Time Travel Debugging (TTD) utility (tttracer.exe). Adversaries can leverage tttracer.exe to execute malicious processes or dump process memory, such as LSASS, for credential access. This rule specifically looks for process creation events where tttracer.exe is the parent process, indicating its use to launch other processes.
Page 507 of 680