SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" within process command lines. This technique is often used by malware to dynamically load assemblies, evading static analysis.
Detects attempts to disable or modify Microsoft Defender features using PowerShell commands, specifically targeting various scanning and monitoring capabilities. The rule looks for `Add-MpPreference` or `Set-MpPreference` cmdlets combined with parameters like `DisableArchiveScanning`, `DisableRealtimeMonitoring`, `DisableIOAVProtection`, `DisableBehaviorMonitoring`, `DisableBlockAtFirstSeen`, `DisableCatchupFullScan`, or `DisableCatchupQuickScan` set to `$true` or `1`. It also includes detection for base64 encoded versions of these commands.
Detects the execution of Ngrok, a legitimate utility often abused by threat actors for port forwarding and tunneling. This allows them to expose local services to the internet, bypassing firewalls and network restrictions. The rule specifically looks for common command-line arguments used with Ngrok, such as those for tunneling specific TCP ports (e.g., 139, 445, 3389, 5985, 5986), HTTP services, or configuration file usage.
Detects the usage of "reg.exe" to add Windows Defender folder exclusions. This technique has been observed being used by QakBot (formerly Qbot) to add exclusions for folders within AppData and ProgramData, aiming to evade detection by the antivirus software.
This rule identifies the use of `net.exe`, `net1.exe`, or `w32tm.exe` commands to query system time or time zone information. Adversaries may use these commands to gather information about a target system's time settings, potentially before executing scheduled tasks or to understand the system's geographical context.
This rule detects suspicious execution of 'rundll32.exe' when it attempts to load 'advpack.dll' and specifically calls functions using an obfuscated ordinal number (e.g., '#12' or '#-'). This technique is often used by adversaries to leverage the 'RegisterOCX' function for defense evasion, as it can bypass security monitoring that might not scrutinize rundll32.exe's normal operations or direct DLL function calls.
This rule detects instances where 'rundll32.exe' is executed without any command-line parameters. This behavior has been observed in the context of Metasploit's windows/smb/psexec exploit module, where rundll32.exe is used to proxy execution of malicious code. Legitimate uses of rundll32.exe typically involve specific DLL and function arguments.
Detects the use of the 'shutdown.exe' command-line tool with the '/l' argument, which is used to log off the current user. This activity is considered rare and potentially suspicious as it can be used by adversaries to disrupt user sessions or as part of system manipulation tactics.
This rule detects suspicious child processes spawned by Electron-based applications such as Microsoft Teams, Discord, Slack, GitHub Desktop, Keybase, and web browsers like Edge. The detection logic focuses on the creation of common command-line interpreters and scripting engines (e.g., cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, regsvr32.exe, whoami.exe) or execution from suspicious temporary or user-writable paths (e.g., ProgramData, Temp, AppData\Local\Temp, Users\Public). This behavior could indicate `.asar` file tampering, where an attacker modifies the application's bundled resources to execute malicious code, or the use of these legitimate applications as execution proxies for arbitrary commands. The rule specifically filters out a known legitimate Discord behavior involving `cmd.exe` and `nvidia-smi.exe` to reduce false positives.
This rule detects the presence of a Base64 encoded MZ header within a command line. The MZ header is characteristic of Windows executable files. Its appearance in a command line, especially in a Base64 encoded format, often indicates an attempt to execute malicious code or a payload that has been obfuscated to evade detection. This technique is commonly used by attackers to deliver and execute malware.
Page 526 of 680