SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the rcedit tool to modify Portable Executable (PE) metadata properties such as OriginalFileName, CompanyName, FileDescription, ProductName, ProductVersion, and LegalCopyright. This activity could indicate an attempt to conceal the true nature of an executable, potentially for defense evasion by masquerading as a legitimate utility or by removing indicators from malicious tools.
Detects the execution of a renamed version of the "Mavinject" process. Mavinject.exe is a legitimate Microsoft utility that can be abused to perform process injection, often using the "/INJECTRUNNING" flag. This rule specifically looks for instances where the original file name (mavinject32.exe or mavinject64.exe) does not match the executed image name, indicating a potential rename for defense evasion.
Detects the execution of a renamed MegaSync.exe, which has been observed in use by ransomware families such as Nefilim, Sodinokibi (REvil), Pysa, and Conti. The rule specifically looks for processes where the original filename metadata is 'megasync.exe' but the executed image path does not end with '\megasync.exe', indicating a renaming event.
This rule detects the execution of `rundll32.exe` with the `InstallScreenSaver` command-line argument. This technique can be abused by attackers to execute arbitrary applications as a screensaver file (.scr) for defense evasion, as `rundll32.exe` is a legitimate Windows utility. The rule specifically looks for `rundll32.exe` (or its original filename) and the `InstallScreenSaver` string in the command line.
Detects the stopping of a Windows service using the built-in 'sc.exe' utility. This rule specifically looks for process creation events where 'sc.exe' is executed with the 'stop' command-line argument. While 'sc.exe' is a legitimate system tool, its use to stop services can be indicative of malicious activity, especially when combined with other suspicious behaviors, as adversaries may stop services to disrupt operations, evade defenses, or facilitate data destruction/encryption.
Detects the usage of the 'sqlite' or 'sqlite3' binaries to query specific database files associated with Firefox and other Gecko-based browsers, such as 'cookies.sqlite' and 'places.sqlite'. This activity is indicative of potential data stealing, particularly targeting browser history, bookmarks, and session cookies.
This rule detects suspicious patterns in program names or command-line arguments that are commonly associated with malicious samples, hacktools, or exploit kits. It looks for specific keywords and file names in the 'Image' (executable path) and 'CommandLine' fields. Examples include CVE-related strings, common exploit/artifact names like 'poc.exe', 'meterpreter', and various PowerShell scripts often used in post-exploitation such as 'inject.ps1', 'Invoke-CVE', 'mimikatz.ps1', and 'powercat.ps1'.
This rule detects attempts to enable Windows developer features such as 'Developer Mode' or 'Application Sideloading' via 'SystemSettingsAdminFlows.exe'. Enabling these features allows users to install untrusted packages, which can be leveraged by adversaries for defense evasion or persistence by bypassing standard application signing requirements.
Detects suspicious UltraVNC command line flag combinations that indicate an auto-reconnect upon execution, often used for persistence or remote access. This behavior has been observed in campaigns by the Gamaredon threat group.
Detects attempts to uninstall or terminate security products using the Windows Management Instrumentation Command-line (WMIC) utility. Adversaries often disable or remove security software to evade detection and facilitate their malicious activities. This rule specifically looks for WMIC commands that target common security product names and attempt to uninstall or terminate them.
Page 519 of 680