SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of processes where the command line contains specific Unicode characters that are visually identical (homoglyphs) to ASCII letter characters. Adversaries use homoglyphs as an obfuscation and masquerading technique to make malicious commands or file names appear legitimate, thereby evading detection and tricking users. The rule specifically targets "perfect" homoglyphs that are indistinguishable from their ASCII counterparts.
Detects the presence of keywords like "lsass" and ".dmp" in the command line, which indicates a potential attempt to dump the LSASS process memory. This technique is commonly used by adversaries to extract credentials.
This rule detects suspicious child processes spawned by parent processes that typically should not have any children, or should only have a very limited set of known child processes. The rule specifically looks for child processes of applications like Minesweeper, Winver, Bitsadmin, Csrss, Certutil, Eventvwr, Calc, and Notepad, while filtering out common legitimate child processes for some of these parents (e.g., WerFault.exe, conhost.exe). This behavior can indicate defense evasion or execution of malicious code from an unexpected parent.
Detects suspicious output redirection to the local administrative share (ADMIN$). This technique is often used by malicious scripts or hack tools to stage or exfiltrate data by writing it to a location accessible via the network, specifically targeting the ADMIN$ share on localhost or 127.0.0.1.
Detects a command that accesses the Volume Shadow Copy to extract sensitive files such as the Security or SAM registry hives or the Active Directory database (ntds.dit). This activity is often associated with credential dumping.
Detects suspicious access to Domain Group Policies stored in the SYSVOL share. This rule specifically looks for command-line activity that includes both '\SYSVOL\' and '\policies\', indicating an attempt to interact with Group Policy objects.
This rule detects attempts to delete or resize Volume Shadow Copies using various Windows operating system utilities. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for command-line executions of `powershell.exe`, `pwsh.exe`, `wmic.exe`, `vssadmin.exe`, `diskshadow.exe`, and `wbadmin.exe` with arguments indicating shadow copy deletion or resizing operations. This includes commands like 'shadow delete', 'wbadmin delete catalog', and 'vssadmin resize shadowstorage'.
This rule detects the usage of the Windows Package Manager (winget.exe) to install applications via a local manifest file. Adversaries can abuse winget to download and execute various types of payloads (e.g., .exe, .msi, .msix) from remote sources by providing a YAML manifest file directly to the client. This technique can be used for execution and defense evasion.
Detects the execution of "wmic.exe" with the "process" flag, which adversaries might use to list processes running on the compromised host or list installed software hotfixes and patches. This rule specifically excludes commands that involve creating processes, focusing on reconnaissance activities.
This rule detects the deletion of the 'SD' (Security Descriptor) value within the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\` registry hive. This action is typically performed by adversaries to hide scheduled tasks, making them less visible to standard enumeration tools. This technique has been observed in use by the Tarrask malware.
Page 544 of 680