SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects PowerShell execution using the `Set-Acl` cmdlet to modify the Access Control List (ACL) of a file or folder. This can be used by adversaries to change permissions, potentially granting themselves or other users/groups unauthorized access or denying access to legitimate users/services as a form of defense evasion or impact.
Detects the execution of PowerShell where the parent process is suspicious or uncommon. This rule specifically looks for PowerShell being spawned by processes like web servers (tomcat, httpd, nginx, w3wp), database servers (sqlagent, sqlserver, sqlservr), browsers (chrome, firefox, iexplore, microsoftedge, safari, vivaldi, browser.exe, amigo.exe), or other processes not typically expected to launch PowerShell, such as mshta.exe, regsvr32.exe, rundll32.exe, services.exe, jbosssvc.exe, and php-cgi.exe. This pattern can indicate various forms of compromise, including web shell execution, SQL injection leading to command execution, or malicious scripts launched by compromised applications or user interaction.
Detects the use of X509Enrollment COM objects or their associated CLSID in process command lines. This can be indicative of attempts to manipulate certificates, potentially for defense evasion or to establish trust for malicious purposes, such as installing root certificates.
Detects child processes of 'provlaunch.exe' which might indicate potential abuse to proxy execution. Adversaries may use 'provlaunch.exe', a legitimate Windows binary, to execute arbitrary commands or binaries, bypassing security controls or masquerading malicious activity.
Detects the execution of AdFind with command-line flags commonly associated with reconnaissance activities during attacks. AdFind is a legitimate tool that can be abused by adversaries to gather extensive information about Active Directory environments, including domain trusts, user accounts, computer objects, and group policies.
Detects the execution of the AdvancedRun utility when it attempts to run a process with elevated privileges, specifically in the context of TrustedInstaller, SYSTEM, Local Service, or Network Service accounts. This tool can be used by adversaries for privilege escalation and defense evasion.
Detects the execution of 'csexec.exe', a remote execution tool similar to PsExec. This tool can be used by attackers for lateral movement or remote code execution within a network.
This rule detects the execution of the 'ftp.exe' binary when it has been renamed. Adversaries often rename legitimate system binaries to evade detection by security tools that monitor for specific executable names. The detection logic specifically looks for process creation events where the original filename metadata indicates 'ftp.exe', but the actual image path (the executed file name) is different from 'ftp.exe'. This indicates that the 'ftp.exe' binary has been renamed and then executed.
Detects the execution of a process where the original description is 'Java Update Scheduler' or 'Java(TM) Update Scheduler', but the executable file name is not 'jusched.exe'. This behavior is indicative of an adversary renaming a legitimate utility to evade detection, a technique known to be used by groups like Cobalt Group.
Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries. This technique is often used for defense evasion by proxying execution of malicious content with a trusted, signed binary.
Page 542 of 680