SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of 'ntdsutil.exe' with command-line arguments indicating snapshot operations, specifically mounting a snapshot. This activity can be suspicious as 'ntdsutil.exe' is a legitimate Active Directory diagnostic tool that can be abused by adversaries to extract the NTDS.dit file, which contains sensitive credential information.
This rule detects the execution of 'odbcconf.exe' with the 'INSTALLDRIVER' action where the driver specified in the command line does not have a '.dll' extension. This behavior is often indicative of defense evasion, as adversaries may abuse odbcconf.exe to execute arbitrary code or bypass application control by installing non-DLL files as drivers.
This rule detects the creation of any child process by 'odbcconf.exe'. Typically, 'odbcconf.exe' should not spawn child processes. Adversaries often abuse 'odbcconf.exe' to proxy execution of malicious payloads, such as DLLs, to bypass application control solutions. This behavior is indicative of potential defense evasion tactics.
Detects an executable in a user's directory that is spawned by a Microsoft Office application (Word, Excel, PowerPoint, Publisher, Visio, Access, Equation Editor). This behavior is often associated with malicious documents attempting to execute payloads.
This rule detects attempts to bypass Antimalware Scan Interface (AMSI) functionalities by using specific strings or NULL bits in command-line arguments. Adversaries often employ such techniques to obfuscate malicious scripts or commands, preventing security products from detecting and blocking them. The rule specifically looks for patterns like "if(0){{{0}}}' -f $(0 -as [char]) +" and "#<NULL>" in the command line, which are known indicators of AMSI bypass attempts.
This rule detects command-line executions that include specific function calls, 'LoadAssemblyFromPath' or 'LoadAssemblyFromNS', which are associated with the 'CL_LoadAssembly.ps1' script. This script can be leveraged to load .NET assemblies, potentially bypassing AppLocker controls and executing arbitrary code. The detection focuses on instances where these function calls are made directly via command-line arguments, such as through PowerShell's '-Command' or '-ScriptBlock' flags.
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. This activity is often seen in reconnaissance phases where attackers map out the network environment.
Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features such as IEHarden, Data Execution Prevention (DEP), and the First Run Customize wizard.
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicative of base64 encoded commands. Adversaries often use base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by simple string matching. The rule specifically looks for common encoding flags such as '-e', '-en', '-enc', '-enco', or '-ec'. It filters out legitimate uses of '-Encoding' and activity from Azure Guest Configuration worker processes to reduce false positives.
Detects calls to PowerShell cmdlets used to export certificates from the local certificate store. Threat actors have been observed abusing this technique to steal private keys from compromised machines, which can then be used for authentication or decryption.
Page 541 of 680