SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,502 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when OpenWith.exe is used to execute another binary, indicated by the presence of '/c' in the command line. This technique can be used by adversaries to bypass process and/or signature-based defenses by proxying execution with a trusted binary.
Detects the execution of 'OpenConsole.exe' when it is not launched from the legitimate Windows Terminal path. This behavior is often indicative of an adversary attempting to use 'OpenConsole.exe' as a Living Off The Land Binary (LOLBIN) to bypass application whitelisting and execute other binaries.
Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands, specifically looking for the 'script:' argument which can be abused for proxy execution of remote files. This technique is often used for defense evasion.
This rule detects the execution of `SyncAppvPublishingServer.vbs` with a command-line argument containing a semicolon, which is indicative of arbitrary PowerShell code execution. Adversaries can abuse this legitimate VBScript to bypass PowerShell execution restrictions and evade defensive measures by proxying execution through a trusted, signed binary.
Detects the execution of msdt.exe by a suspicious parent process, which is indicative of exploitation techniques such as the 'Follina' vulnerability (CVE-2022-30190). The rule specifically looks for msdt.exe being spawned by common scripting or system utility processes often abused in such attacks.
This rule detects the execution of PowerShell code through the `sqlps.exe` utility, which is part of the Microsoft SQL Server utilities. This method can be used by adversaries to bypass detection mechanisms that rely on PowerShell script block logging, as `sqlps.exe` does not log script blocks.
Msxsl.EXE Execution
Sigma
Detects the execution of the MSXSL utility (msxsl.exe). This utility can be abused by adversaries to execute Extensible Stylesheet Language (XSL) files, potentially bypassing application whitelisting defenses and executing arbitrary code. The rule specifically looks for the execution of 'msxsl.exe'.
This rule detects the use of 'net.exe' or 'net1.exe' with the 'use' command to mount an administrative share (e.g., C$, ADMIN$) on a Windows system. This activity is often associated with lateral movement by adversaries.
This rule detects the execution of 'net.exe' or 'net1.exe' with a password provided directly in the command line. This is a security risk as it exposes credentials and can be used for lateral movement, persistence, or privilege escalation. The rule specifically looks for the 'use' keyword, a colon followed by an asterisk and a backslash (indicating a password field), and '/USER:* *' to identify password usage in the command line arguments.
Detects the execution of the Windows Defender `OfflineScannerShell.exe` from a non-standard directory. This binary is known to be vulnerable to DLL side-loading, specifically loading `mpclient.dll` from its current working directory. An adversary could place a malicious `mpclient.dll` in a non-standard directory and then execute `OfflineScannerShell.exe` from that directory to achieve arbitrary code execution.
Page 550 of 680