SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,505 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects changes to the registry for the currently logged-in user to disable PowerShell module logging, script block logging, transcription, or script execution logging. This activity is often performed by adversaries to evade detection by hindering forensic analysis and logging capabilities.
This rule detects the installation or modification of keyboard preload settings in the Windows Registry, specifically looking for suspicious keyboard layouts such as Persian (Iran) or Vietnamese. This activity is considered suspicious in environments where such layouts are not expected, particularly in systems maintained by US staff. The detection focuses on changes to the 'Keyboard Layout\Preload' and 'Keyboard Layout\Substitutes' registry keys.
Detects potential exploitation of CVE-2021-40444, a Microsoft MSHTML Remote Code Execution vulnerability, by identifying suspicious process patterns. Specifically, it looks for 'control.exe' being spawned by Microsoft Office applications (Winword, Powerpnt, Excel) with command-line arguments that do not match known benign patterns for 'control.exe input.dll'. This behavior has been observed in in-the-wild exploitations of this vulnerability.
Detects a specific broken command line argument 'choice /t %d /d y /n >nul' used by the Goofy-Guineapig backdoor, as detailed in the NCSC report. This command is likely an attempt to introduce a delay or interact with a prompt in a non-standard way, which could indicate malicious activity.
Detects attempts to exploit the VMware Workspace ONE Access Admin Remote Code Execution vulnerability (CVE-2022-31659) by monitoring for POST requests to the '/SAAS/jersey/manager/api/migrate/tenant' URI. This URI is associated with the migration API, and suspicious activity here could indicate an attacker attempting to leverage the vulnerability for remote code execution.
Detects the creation of a specific '.url' file named 'file001.url' within the 'Recent' folder of Microsoft Office. This activity has been observed in potential exploitation attempts related to CVE-2023-36884, where adversaries drop such files to achieve persistence or execute malicious code.
Detects the creation of an 'svchost.exe' process with specific command line flags ('-k msupdate', '-k msupdate2', or '-k alg') that have been observed in use by the ColdSteel RAT for persistence and defense evasion. This pattern indicates the RAT establishing itself as a service to maintain access on a compromised system.
Detects the creation of a Windows service named "WerFaultSvc" with a specific ImagePath pattern, which has been identified as a persistence mechanism used by the SNAKE malware (also known as EKANS) as described in CISA reports. The rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, where the service name contains 'WerFaultSvc' and the ImagePath starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe'.
Detects unusually long PowerShell command lines (1000 characters or more) which can be indicative of obfuscated or complex malicious scripts being executed. Attackers often use long command lines to evade detection by packing malicious code, base64 encoded commands, or other obfuscation techniques into a single line.
This rule identifies when a suppression rule is created in Azure. Adversaries might create suppression rules to evade detection by preventing security alerts from being generated or displayed for their malicious activities.
Page 520 of 680