SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of 'aspnet_regiis.exe' with specific command-line arguments to decrypt Microsoft IIS connection strings. This activity is indicative of an attacker, potentially with web shell access, attempting to extract sensitive credentials like MSSQL service account passwords from IIS configurations.
This rule detects the suspicious execution of InstallUtil.exe, a legitimate .NET utility, when it is used to execute an image without logging its activity. Adversaries often leverage InstallUtil.exe for defense evasion and bypassing application control by executing malicious code through a trusted, signed Microsoft binary. The specific conditions for detection are the execution of InstallUtil.exe from a Microsoft .NET Framework directory with command-line arguments that disable logging (`/logfile= ` and `/LogToConsole=false`). This behavior is indicative of an attempt to hide malicious activity.
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
This rule detects the creation of a Java process that is configured for remote debugging, specifically when the debugging interface is bound to an address other than localhost (127.0.0.1 or localhost). This configuration allows external connections to the Java Debug Wire Protocol (JDWP) port, which can be exploited by attackers to gain control over the Java application or the underlying system. The rule looks for the 'transport=dt_socket,address=' string in the command line, combined with the absence of 'address=127.0.0.1' or 'address=localhost'. It also includes a check for older JVM versions ('jre1.' or 'jdk1.') which might be more vulnerable.
Detects the execution of the Microsoft-signed PowerShell script 'Launch-VsDevShell.ps1' with specific command-line arguments ('VsWherePath ' or 'VsInstallationPath '). This script can be abused to proxy the execution of other commands, potentially for defense evasion.
This rule detects the execution of 'ScriptRunner.exe' with the '-appvscript' command-line argument. 'ScriptRunner.exe' is a legitimate Windows binary that can be abused to proxy execution, potentially bypassing whitelisting or other security controls. This specific command-line argument indicates its use in the context of App-V scripting, which can be leveraged for malicious purposes.
This rule detects attempts to remove Windows Defender definition files using the MpCmdRun.exe utility with the '-RemoveDefinitions -All' command-line arguments. This action is typically performed by adversaries to disable or impair Windows Defender's ability to detect malicious software, thereby facilitating their activities and avoiding detection.
This rule detects attempts to discover network connections on a system using the built-in Windows `net.exe` or `net1.exe` utility with the `use` or `sessions` commands. Adversaries often use these commands to map out network resources and active user sessions on compromised systems.
Detects the execution of 'netsh.exe' with the 'trace' and 'start' flags, indicating that a network trace capture has been initiated. This activity can be used by adversaries for network sniffing to gather information about the environment, including credentials or network configurations.
Detects the execution of "odbcconf.exe" with the "INSTALLDRIVER" argument, which is used to install new ODBC drivers. Attackers often abuse this legitimate Windows utility to install and execute malicious DLLs, bypassing application control solutions and achieving defense evasion.
Page 540 of 680