SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of 'remote.exe', a legitimate utility part of WinDbg in the Windows SDK. Adversaries can abuse remote.exe for application whitelisting (AWL) bypass and to execute remote files, making it a living-off-the-land binary (LOLBin). The detection is based on the image path ending with '\remote.exe' or the original filename being 'remote.exe'.
Detects the execution of 'nltest.exe', a Windows command-line utility that can be used by adversaries for information discovery, specifically to enumerate domain trusts and discover system network configurations.
This rule detects the potential for arbitrary file downloads initiated by Microsoft Office applications (Excel, PowerPoint, Word). It specifically looks for instances where these applications are executed and their command line arguments contain HTTP or HTTPS URLs, indicating an attempt to download content from the internet. This behavior can be abused by adversaries to fetch malicious payloads.
Detects the use of Plink (PuTTY Link) for suspicious remote port forwarding to a local port. This technique can be used by adversaries to bypass network restrictions and establish tunnels for command and control or data exfiltration.
Detects PowerShell command lines that contain both the 'hidden' argument and specific Base64 encoded keywords. These keywords are often associated with malicious PowerShell scripts used for various post-exploitation activities, including process injection, memory manipulation, and remote thread creation. The rule aims to identify obfuscated and stealthy execution of malicious PowerShell.
Detects attempts to decompress Gzip archives using PowerShell's GZipStream::Decompress method. This technique can be used by adversaries to unpack malicious payloads that have been compressed to evade detection.
This rule detects the use of PowerShell cmdlets to exfiltrate email addresses. Specifically, it looks for PowerShell processes executing commands that include 'Add-PSSnapin', 'Get-Recipient', '-ExpandProperty', 'EmailAddresses', 'SmtpAddress', and '-hidetableheaders'. This combination of cmdlets is indicative of an attempt to enumerate and extract email addresses from a system, likely for exfiltration purposes.
Detects the deletion of Windows Volume Shadow Copies using PowerShell with WMI (Get-WmiObject/Get-CimInstance) or CIM (Remove-WmiObject/Remove-CimInstance) commands. This technique is commonly employed by ransomware families like Sodinokibi/REvil to prevent system recovery.
Detects the execution of the AdvancedRun utility, which can be used to launch applications with different user permissions, including SYSTEM, or with modified environment variables. This utility is often used for legitimate administrative tasks but can also be leveraged by adversaries for privilege escalation or defense evasion, particularly by running processes with hidden windows.
Detects the execution of the NSudo utility, a tool that allows users to run programs with elevated privileges such as System, Trusted Installer, or with all privileges enabled. The rule specifically looks for NSudo executable names and common command-line arguments used to request these elevated privileges.
Page 518 of 680