SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects execution of regsvr32.exe where the DLL being registered or unregistered is located in a potentially suspicious directory such as temporary folders or public user directories. This technique is often used by adversaries for defense evasion and to bypass application whitelisting.
This rule detects the execution of the AutoHotkey.exe binary when it has been renamed. It identifies this by looking for specific PE metadata fields such as 'Product' or 'Description' containing 'AutoHotkey', or 'OriginalFileName' being 'AutoHotkey.exe' or 'AutoHotkey.rc', while simultaneously filtering out executions where the image path ends with or contains the legitimate 'AutoHotkey.exe' or its variants.
Detects the execution of a renamed Plink binary, which is often used by adversaries for SSH tunneling and data exfiltration. The rule specifically looks for the original filename 'Plink' combined with command-line arguments indicative of port forwarding ('-l forward', '-P', '-R'), while filtering out legitimate executions of 'plink.exe' to reduce false positives.
Detects the execution of PsExec's service component (psexesvc.exe) when it has been renamed. This often indicates an attempt to evade detection by security tools that monitor for the default service name, as legitimate administrators typically use the original name.
This rule detects the execution of 'rundll32.exe' with specific command-line arguments ('keymgr' and 'KRShowKeyMgr') which indicates an attempt to invoke the Stored User Names and Passwords dialogue, also known as the Key Manager. This activity can be used by adversaries to access or backup stored credentials.
This rule detects the use of the `sc.exe` utility to modify the security descriptor of a Windows service. Specifically, it looks for the `sdset` command-line argument, which can be used to grant special permissions to a service, potentially allowing it to be hidden or manipulated for persistence and defense evasion. This technique can be used by adversaries to maintain access and avoid detection by making services less visible to standard enumeration tools.
Detects when adversaries delete important scheduled tasks using `schtasks.exe` to disrupt system functionality or security mechanisms. The rule specifically targets the deletion of tasks related to critical Windows components like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate, which can indicate an attempt to disable or interfere with essential system services or security features.
Detects the installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
This rule detects the execution of command-line tools like 'dir' or 'findstr' in conjunction with specific file extensions (e.g., .doc, .pdf, .txt) that are commonly associated with sensitive data or credentials. This behavior indicates an attempt at automated collection of data, potentially for exfiltration or further analysis by an adversary. The rule specifically looks for 'dir' commands with '/b' (bare format) and '/s' (subdirectories) flags, or 'findstr' with '/e' (end of line) and '/si' (case-insensitive search for string in files) flags, targeting common document and text file types.
Detects command line activity that attempts to clear or disable Event Tracing for Windows (ETW) trace logs. This behavior is indicative of logging evasion, where an attacker tries to remove or prevent the collection of forensic evidence.
Page 534 of 680