SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
This rule detects the execution of the PowerShell cmdlet `Get-SmbShare`. Adversaries often use this cmdlet to discover shared folders and drives on remote systems, which can help them identify valuable information for collection or potential targets for lateral movement. This activity is a common precursor to further reconnaissance and exploitation within a network.
This rule detects the usage of the PowerShell cmdlet `Test-NetConnection` to probe network connectivity to a specified computer name and port, specifically looking for connections to ports other than the commonly used 80 or 443. This behavior can indicate an adversary attempting to establish or test communication channels over non-standard ports, potentially to bypass network defenses or obscure command and control activities.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify a service's security descriptor (SDDL) to include 'DCLCWPDTSD'. This specific SDDL string is known to hide services from common utilities like 'sc.exe' and 'Get-Service', effectively making them invisible. This technique is primarily effective in PowerShell 7 and later versions.
Detects attempts to access the LSASS process memory by tools or processes that have the keyword "dump" in their image name. This behavior is indicative of credential dumping activities, where adversaries try to extract sensitive information like passwords and hashes from the LSASS process.
This rule detects the execution of the 'hh.exe' utility when it is used to open Compiled HTML Help (.chm) files. Adversaries may abuse 'hh.exe' to execute malicious code embedded within CHM files, often as a method of defense evasion or to bypass application controls. The rule specifically looks for 'hh.exe' as the process image and the '.chm' extension in the command line arguments.
Detects the use of the .NET utility InstallUtil.exe to download files from remote HTTP or FTP sources. This technique is often used by adversaries to bypass application control and execute malicious code by leveraging a trusted, signed Microsoft binary.
Detects the execution of the "jsc.exe" (JScript Compiler). Attackers might abuse this in order to compile JScript files on the fly and bypass application whitelisting.
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a Living Off The Land Binary (LOLBIN) to execute arbitrary commands and binaries. The rule specifically looks for command lines containing ' run run-cmd ' and excludes executions where the parent process is 'cleanapi.exe' or 'kavremover.exe', as these are legitimate parent processes for the dropped binary.
This rule detects the use of DataSvcUtil.exe, a legitimate Microsoft utility, with command-line arguments indicative of data exfiltration. Specifically, it looks for the presence of '/in:', '/out:', and '/uri:' parameters in the command line, combined with the execution of 'DataSvcUtil.exe'. This behavior is often associated with Living Off The Land Binaries (LOLBAS) techniques where adversaries leverage legitimate system tools for malicious purposes, in this case, to exfiltrate data.
Page 517 of 680