SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious command lines commonly used by Covenant C2 framework launchers, specifically looking for PowerShell execution with hidden window styles and encoded commands, or specific Covenant-related strings like 'GruntHTTP'.
This rule detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. It specifically looks for command-line arguments that use variable manipulation (e.g., $PSHome, $ShellId, $env:Public, $env:ComSpec) and string concatenation to construct and execute PowerShell commands, which is a common technique for defense evasion.
Detects the execution of tools from SecurityXploded, specifically focusing on 'PasswordDump.exe'. These tools are often used for credential dumping, which involves extracting credentials from various password stores on a system.
Detects the execution of SharpChisel, a .NET port of the Chisel tunneling tool, by monitoring process creation events for the executable name or product metadata. This tool can be used by adversaries to establish internal proxies for command and control traffic.
This rule detects the execution of a SILENTTRINITY stager by looking for the string 'st2stager' within the 'Description' field of process creation events. This string is typically found in the PE metadata of the stager executable, indicating its use.
This rule detects the execution of the `hostname.exe` utility. Adversaries often use this command-line tool to gather information about the compromised system, specifically its hostname, as part of their discovery phase. This activity is typically a precursor to further malicious actions.
Detects when a shell process (bash, cmd, or PowerShell) is spawned by a Java executable. This activity can be indicative of exploitation, such as the Log4j vulnerability, where an attacker leverages a Java application to execute arbitrary commands on the underlying system. The rule filters out common CI build agent activities to reduce false positives.
This rule detects the execution of 'DeviceCredentialDeployment.exe', a legitimate Windows binary that can be abused to hide processes from view. This technique is often used for defense evasion.
Detects the execution of the built-in Windows script 'gatherNetworkInfo.vbs' via cscript.exe or wscript.exe. This script is designed to gather detailed network information about the target machine, which can be leveraged by adversaries for reconnaissance purposes.
This rule detects the execution of msdeploy.exe with specific command-line arguments that indicate an attempt to execute arbitrary commands. Adversaries may abuse msdeploy.exe, a legitimate Microsoft utility, to proxy execution of malicious content, bypassing security controls that monitor for direct execution of suspicious binaries. The rule specifically looks for the 'verb:sync', '-source:RunCommand', and '-dest:runCommand' arguments in conjunction with msdeploy.exe, which are indicative of this technique.
Page 549 of 680