SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of child processes by SysAidServer, specifically when the parent process is either 'java.exe' or 'javaw.exe' and its command line contains 'SysAidServer'. This activity has been observed in intrusions attributed to the MERCURY (MuddyWater) threat actor, suggesting potential exploitation or unauthorized execution within the SysAid environment.
Detects the execution of 'CustomShellHost.exe' where its child process is not 'C:\Windows\explorer.exe'. This behavior can indicate an attempt to use CustomShellHost for proxy execution, potentially bypassing security controls or for defense evasion.
This rule detects indirect command execution by monitoring for processes where 'pcwrun.exe' is the parent process. 'pcwrun.exe' is part of the Program Compatibility Assistant and can be abused to proxy execution of other commands or binaries, a technique often used for defense evasion.
Detects the usage of the "sftp.exe" binary as a Living Off The Land Binary (LOLBIN) by abusing the "-D" flag to potentially execute arbitrary commands or binaries. This technique can be used for defense evasion or execution.
Detects the execution of the Visual Basic Command Line Compiler (vbc.exe) where it acts as a parent process to the Windows Resource to Object Converter (cvtres.exe). This combination indicates successful code compilation, which can be abused by adversaries to compile malicious code on a compromised system.
Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution. This rule specifically looks for common scripting and system utilities being launched as child processes of mshta.exe, which is often abused for defense evasion and execution.
Detects when the 'net.exe' or 'net1.exe' utility is used with the 'share' and '/delete' commands to remove a mounted network share. This activity can be performed by adversaries to clean up traces of their operations.
Detects the execution of netsh with the "add helper" flag to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy, getting called whenever netsh.exe is executed.
Detects the execution of 'odbcconf.exe' where the DLL being registered is located in a potentially suspicious directory. Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads, often placing the DLL in common temporary or public user directories to evade detection or bypass application control.
Detects the execution of the PDQ Deploy Console, which is a remote administration tool. This rule identifies the creation of processes associated with the PDQ Deploy Console based on its description, product name, company, or original file name. This tool can be used for legitimate software deployment but can also be leveraged by adversaries for execution and lateral movement.
Page 532 of 680