SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,501 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of 'PresentationHost.exe', a utility designed to run '.xbap' (Browser Applications) files, when it attempts to download arbitrary files from HTTP, HTTPS, or FTP sources. This behavior can be abused for defense evasion and execution of malicious content.
This rule detects attempts to abuse the `print.exe` utility for remote file copy operations. Attackers can leverage `print.exe`, a legitimate Windows binary, to transfer files by specifying a remote destination using the `/D` switch and a file with an `.exe` extension. This technique is often used for defense evasion by proxying execution with a trusted system binary.
This rule detects when `Microsoft.NodejsTools.PressAnyKey.exe` spawns a child process. This executable is part of Visual Studio's Node.js tools and is designed to pause execution until a key is pressed. However, it can be abused to proxy the execution of arbitrary binaries, allowing an attacker to bypass certain security controls or execute malicious code under the guise of a legitimate Visual Studio component.
Detects the execution of NirCmd, a legitimate command-line utility, when used with specific command-line arguments that indicate execution of other commands or scripts. This could be indicative of an adversary using NirCmd for execution, potentially to hide windows or run commands with specific privileges.
Detects the execution of WebBrowserPassView.exe, a password recovery tool that reveals passwords stored by various web browsers including Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera. This tool is often used by adversaries to extract credentials from compromised systems.
This rule detects the use of 'rar.exe' to add files to an archive. Adversaries often compress collected data, such as sensitive documents, before exfiltration to make it more portable and reduce the amount of data transferred over the network. The detection specifically looks for the execution of 'rar.exe' with the 'a' command-line argument, which is used for adding files to an archive.
This rule detects attempts to enumerate credentials stored in the Windows Registry using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query for string values (`/t REG_SZ`) recursively (`/s`) within the HKLM (Local Machine) or HKCU (Current User) hives, or specifically targets the PuTTY sessions key in HKCU. This activity is indicative of an adversary searching for insecurely stored credentials that can be used for further access.
Detects potentially suspicious execution of the Regasm or Regsvcs utilities when they are used with command-line arguments containing uncommon file extensions. This behavior can indicate an attempt to bypass application control or execute malicious code through these trusted Windows utilities, often associated with defense evasion techniques.
Detects when 'DllRegisterServer' is called in the command line of a process that is not 'rundll32.exe'. This behavior is indicative of an adversary renaming the 'rundll32' utility to evade detection, while still leveraging its functionality to execute DLLs.
This rule detects the use of the 'sc.exe' utility to modify service DACLs (Discretionary Access Control Lists) by adding specific permissions ('DCLCWPDTSD'). This technique is often used by threat actors to hide services, making them unremovable and persistent, thereby achieving defense evasion, persistence, and privilege escalation.
Page 552 of 680