SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,508 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of "VSIISExeLauncher.exe", a legitimate binary associated with Visual Studio/VS Code, when it is used to launch other executables. Adversaries may abuse this utility to proxy execution of malicious payloads, potentially bypassing application control solutions. The detection specifically looks for the execution of VSIISExeLauncher.exe combined with command-line arguments indicating the launch of another program (e.g., using '-p' or '-a').
Detects suspicious child processes spawned by the SQL Server process (sqlservr.exe). This activity is highly indicative of successful exploitation, such as Remote Code Execution (RCE) or SQL Injection, where an attacker leverages the SQL Server to execute arbitrary commands on the underlying operating system. The rule specifically looks for common system utilities and scripting interpreters that are often used by attackers for reconnaissance, persistence, or further compromise.
This rule detects the execution of the `nslookup` command specifically querying for LDAP service records (`_ldap._tcp.dc._msdcs.`). This type of query is often used during the reconnaissance phase by attackers to discover Active Directory domain controllers and their associated services within a network. This activity can indicate an adversary attempting to map out the network infrastructure.
Detects the use of 'nltest.exe' with command-line arguments indicative of reconnaissance activity, specifically targeting domain trust discovery and domain controller enumeration. Adversaries often use 'nltest.exe' to gather information about the network environment, which can aid in lateral movement and privilege escalation within Windows domains.
Detects the execution of 'ntdsutil.exe', a Windows command-line tool that can be used to perform various operations on the Active Directory database (NTDS.DIT). Adversaries may use this tool to extract credential information or other sensitive data from the NTDS.DIT file.
Detects suspicious child processes spawned from Microsoft Outlook. This often indicates an attempt to execute malicious code or scripts via social engineering or exploitation of vulnerabilities within Outlook.
This rule detects suspicious execution of 'Powercfg.exe' to modify power settings related to the lock screen timeout. Adversaries may use this technique to prevent a system from entering a dormant state, thereby maintaining access and hindering defensive mechanisms. The rule specifically looks for command-line arguments that change the AC (alternating current) or DC (direct current) standby timeout, or modify the video display timeout when the system is locked.
This rule detects the installation of a root certificate from suspicious locations using PowerShell's `Import-Certificate` cmdlet. Adversaries may install root certificates to bypass security warnings when connecting to their controlled web servers, facilitating man-in-the-middle attacks or credential harvesting. The rule specifically looks for the `Import-Certificate` cmdlet targeting `Cert:\LocalMachine\Root` and originating from common temporary or user-writable directories like `AppData\Local\Temp\`, `Windows\TEMP\`, `Desktop\`, `Downloads\`, `Perflogs\`, or `Users\Public\`.
This rule detects the execution of 'adidnsdump' via 'python.exe'. Adidnsdump is a tool used for enumerating and exporting all DNS records in an Active Directory integrated DNS zone. This activity is typically performed for reconnaissance purposes within internal networks, allowing an attacker to gather information about the network's structure and resources by querying/modifying DNS records via LDAP.
This rule detects the execution of Remote Utilities RAT (RURAT) executables (`rutserv.exe` or `rfusclient.exe`) or any process with 'Remote Utilities' in its product name, when they are launched from an unusual location, specifically outside of the standard 'C:\Program Files\Remote Utilities' or 'C:\Program Files (x86)\Remote Utilities' directories. This behavior can indicate an attempt to evade detection or establish persistence by placing the RAT in a non-standard path.
Page 508 of 680