SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,502 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects PowerShell script block text containing "Win32_PnPEntity". This WMI class is used to query information about Plug and Play devices, which can include peripheral devices. Adversaries may use this to gather information about attached peripheral devices and components connected to a computer system for discovery purposes.
Detects when the CertOC.exe utility is used to download a file from a remote HTTP source. This behavior is indicative of an adversary using a living-off-the-land binary (LOLBIN) for ingress tool transfer.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') in conjunction with an 'http' string in the command line, indicating an attempt to download files from a remote HTTP source. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
This rule detects potential NTLM coercion attempts using the built-in Windows utility 'certutil.exe'. Specifically, it looks for command-line executions of 'certutil.exe' that include both the '-syncwithWU' flag and a UNC path (indicated by '\\'). This combination is known to be abused by attackers to force a Windows machine to authenticate to an attacker-controlled server, thereby coercing it to send its NTLM hash.
Detects the use of 'chcp.com' to switch the system's active code page to a less common or potentially suspicious language, which could be used for defense evasion or to support specific malware functionalities.
This rule detects the creation of a symbolic link (symlink) to a Volume Shadow Copy using the 'mklink' command-line utility. Adversaries often create symlinks to shadow copies to access and exfiltrate sensitive data, such as credential hashes from the Security Account Manager (SAM) database or the Active Directory database (NTDS.dit), without directly interacting with the live system files. This technique is commonly used as part of credential dumping activities.
This rule detects attempts to evade antivirus/EDR detection by piping the content of ntdll.dll to another file or a named pipe. This technique, as demonstrated in the 'NtdllPipe' proof-of-concept, involves using the 'type' command to read the contents of 'ntdll.dll' and redirecting its output, often to a named pipe, to bypass security controls that might monitor direct file access or execution of ntdll.dll.
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
Detects the use of dtrace.exe to perform a kernel dump on Windows systems. This activity is suspicious as dtrace.exe is a legitimate debugging tool that can be abused for system information discovery or credential access by dumping kernel memory.
Detects the execution of 'GfxDownloadWrapper.exe' with a URL as a command-line argument, indicating an attempt to download a file. This utility is part of Intel Graphics Command Center and can be abused for ingress tool transfer.
Page 548 of 680