SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the use of 7-Zip to compress and password-protect data, which is a common technique used by adversaries for exfiltration. It specifically looks for the execution of 7-Zip executables (7z.exe, 7zr.exe, 7za.exe) combined with command-line arguments indicating both compression/archiving ('a' or 'u') and password protection ('-p').
Detects suspicious child processes spawned by "aspnet_compiler.exe". This often indicates an adversary is abusing the legitimate `aspnet_compiler.exe` utility for proxy execution, potentially to bypass application controls or execute malicious code from unexpected locations. The rule specifically looks for common executables like `calc.exe` or `notepad.exe` and processes launched from suspicious temporary or user-specific directories.
Detects the use of the built-in Windows utility 'cipher.exe' with the '/w:' argument to overwrite deleted data on disk. This technique is often used by adversaries to destroy data and files, making them irrecoverable by forensic methods, thereby impacting system availability.
Detects a possible process memory dump of lsass.exe using a renamed or masqueraded executable named 'TrolleyExpress.exe'. This technique leverages the whitelisted nature of the legitimate Citrix TrolleyExpress.exe to evade detection while attempting to dump LSASS memory, often indicated by command-line arguments targeting process IDs in the 700-999 range or the '-ma' flag for memory dumping.
Detects potential path traversal attempts via cmd.exe, which could indicate command or argument confusion/hijacking. The rule looks for cmd.exe being executed with command line arguments containing '/c', '/k', or '/r' and a path traversal sequence like '/../../'.
This rule detects the creation of child processes by 'cmstp.exe', the Microsoft Connection Manager Profile Installer. Adversaries often abuse cmstp.exe to proxy execution of malicious code, bypass User Account Control (UAC), or evade application control defenses by loading and executing DLLs or COM scriptlets. This detection specifically looks for any process that has 'cmstp.exe' as its direct parent.
This rule detects the execution of `fsutil.exe` with specific command-line arguments to set `SymlinkEvaluation`. This action can be used by adversaries, such as ransomware, to enable symbolic link following, potentially allowing them to access and encrypt files through shortcuts or junctions that would otherwise be inaccessible.
This rule detects the creation of suspicious child processes by 'GoogleUpdate.exe'. It specifically looks for any child process that is not a known legitimate Google-related executable (e.g., other GoogleUpdate components, GoogleCrashHandler, or specific setup/installer executables like 'setup.exe', 'chrome_updater.exe', 'chrome_installer.exe'). This behavior could indicate an attempt to leverage a legitimate Google process for malicious activity, such as defense evasion or persistence.
This rule detects suspicious invocations of the `fsutil.exe` utility, specifically when it's used to delete the USN journal, create a USN journal with a small size, or set zero data to a file. These actions are often associated with ransomware or other malicious activity aimed at defense evasion and data destruction, as seen in campaigns like NotPetya and Lockbit.
This rule detects attempts to disable HTTP logging on a Windows Internet Information Services (IIS) web server using the 'appcmd.exe' utility. Specifically, it looks for command-line arguments that set the 'httplogging' section with 'dontLog:true'. This activity is associated with defense evasion tactics, as observed by threat groups like Threat Group-3390 (Bronze Union), to remove forensic evidence of their activities.
Page 539 of 680