SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of "csvde.exe" with the '-f' flag, indicating an attempt to export the Active Directory structure. This tool is often used by adversaries for discovery and collection of domain account information.
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe". These interpreters can be used by adversaries for application whitelisting bypass and to execute F# code via scripts or inline, potentially for malicious purposes.
Detects the execution of SharpLdapWhoami, a tool designed to query LDAP services on a domain controller to identify the current user, similar to the 'whoami' command. The rule looks for the executable name, original filename, product name, and specific command-line arguments related to authentication methods.
This rule detects suspicious registration of IIS modules, a technique used by adversaries to establish persistence on web servers. It specifically looks for `w3wp.exe` (IIS worker process) as the parent process executing commands related to adding modules via `appcmd.exe`, or using PowerShell with `system.enterpriseservices.internal.publish`, or using `gacutil` with the `/I` flag. These activities are indicative of malicious IIS extensions or backdoors being installed, as described in Microsoft's threat report on IIS backdoors.
Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution. This technique involves using wscript.exe or cscript.exe to execute manage-bde.wsf, which in turn can be used to execute other commands or scripts, bypassing certain security controls.
Detects execution of commands and binaries from the context of the Program Compatibility Assistant (Pcalua.exe). This can be used as a Living Off The Land Binary (LOLBIN) to bypass application whitelisting.
Detects the execution of PowerShell scripts via 'Runscripthelper.exe' when the command line contains 'surfacecheck'. This behavior is suspicious as 'Runscripthelper.exe' is a legitimate Windows binary that can be abused for indirect command execution, often as part of Living Off The Land Binaries and Scripts (LOLBAS) techniques.
This rule detects the execution of PowerShell code through the `sqltoolsps.exe` utility, which is part of Microsoft SQL Server Management Studio. This method can be used to bypass logging mechanisms for script blocks, making it a technique for defense evasion.
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest' using `net.exe` or `net1.exe`. This includes actions like enabling/disabling accounts or changing passwords, which are often performed by adversaries for persistence or impact.
Detects the usage of the `netsh.exe` command-line utility to modify system firewall rules, specifically to open port 3389 for RDP connections. This activity has been observed in campaigns involving the Sarwent malware, where adversaries manipulate firewall settings to enable remote access.
Page 525 of 680