SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location, a technique used by the Goofy Guineapig backdoor to evade detection. The rule specifically looks for instances where both the parent and child process images are named 'GoogleUpdate.exe', but the child process is not located in standard Google installation or update paths.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the service's ImagePath contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS obfuscation technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either ':system.io.compression.deflatestream' or 'system.io.streamreader' within the ImagePath. This combination suggests an attempt to decompress and execute obfuscated PowerShell code as part of a service.
Detects the creation of a new service where the ImagePath contains 'rundll32' and 'shell32.dll' along with obfuscation indicators like '&&', 'value', 'invoke', 'comspec', or 'iex'. This pattern is often used by adversaries to execute obfuscated PowerShell commands via rundll32, specifically leveraging 'shellexec_rundll'.
Detects DNS queries for the domain "anonfiles.com", which is an anonymous file upload platform often used by adversaries for malicious purposes, including data exfiltration. This rule specifically looks for any DNS query containing '.anonfiles.com'.
Detects the creation of memory dump files (.dmp, .hdmp) by common scripting or shell applications such as cmd.exe, powershell.exe, cscript.exe, mshta.exe, pwsh.exe, or wscript.exe. Memory dumps can contain sensitive information like credentials, and their creation by these processes can be indicative of malicious activity, especially if not tied to a legitimate crash.
This rule detects the creation of a dump file by the password dumper tool QuarksPwDump. Specifically, it looks for files created in the 'AppData\Local\Temp\' directory with names starting with 'SAM-' and ending with '.dmp'. This pattern indicates that QuarksPwDump is attempting to dump the Security Account Manager (SAM) database, which contains local user credentials.
Detects the creation of specific output files generated by the built-in Windows reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". This script is known to be used by adversaries for system and network information discovery.
This rule detects the creation of temporary files in a specific path within the AppData\Local\Temp directory. The path contains a unique hash-like string, which is associated with the PCRE.NET package. This activity could indicate the execution or unpacking of applications that utilize the PCRE.NET library, potentially for malicious purposes such as code execution or payload delivery.
This rule detects suspicious file creation activity involving 'colorcpl.exe'. Specifically, it looks for instances where 'colorcpl.exe' is the image creating files in the 'c:\windows\system32\spool\drivers\color\' directory, excluding common color profile file extensions like '.icm', '.gmmp', '.cdmp', and '.camp'. This behavior is indicative of an adversary attempting to hide malicious files within a legitimate system directory by abusing the color management control panel utility.
Detects the creation of '.diagcab' files, which can be used by legitimate installers but also by adversaries for exploitation or data collection. The rule suggests reviewing the filename and its location for further investigation.
Page 528 of 680