SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,499 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of 'fsutil.exe' with the 'drives' command-line argument. This command is used to enumerate connected drives on a Windows system. Adversaries, such as Turla, have been observed using this technique for discovery purposes to gain information about the system's environment.
This rule detects the execution of `rundll32.exe` with a DLL containing the exported function `StartNodeRelay`. This specific function is associated with F-Secure C3, a command and control framework. Detection indicates potential use of this tool for malicious purposes, likely for defense evasion and establishing C2 communications.
Detects command-line arguments that are characteristic of Cobalt Strike modules or commands, which may indicate an operator error where these commands are accidentally typed into a command prompt instead of the Cobalt Strike console. This rule specifically looks for common 'Invoke-' PowerShell module names and other Cobalt Strike related keywords executed via 'cmd.exe'.
This rule detects the execution of rundll32.exe with command-line arguments indicative of Cobalt Strike's StartW function being used to load DLLs. Specifically, it looks for 'rundll32.exe' or 'rundll32 ' in the command line, along with a '.dll' file and either ' StartW' or ',StartW' as the ending argument. This behavior is commonly associated with Cobalt Strike for defense evasion and execution of malicious payloads.
Detects the execution of Htran or Htran-like tools such as NATBypass, identified by specific executable names or command-line arguments. These tools are commonly used for proxying network connections to obscure the origin of malicious traffic.
Detects obfuscated PowerShell execution leveraging MSHTA. The rule specifically looks for command-line arguments that indicate the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)', which are common patterns in MSHTA-based PowerShell obfuscation.
Detects obfuscated PowerShell commands that leverage `clip.exe` to retrieve content from the clipboard for execution. This technique is often used to evade detection by hiding malicious scripts in the clipboard until runtime.
Detects the usage of 'pypykatz' to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored. The rule specifically looks for the execution of 'pypykatz.exe' or 'python.exe' with command-line arguments indicating 'live' and 'registry' access, which are common parameters for dumping credentials from the live registry hive.
Detects the execution of specific commands and DLLs associated with the RedMimicry Winnti playbook, an automated breach emulation utility. The rule looks for 'rundll32.exe' or 'cmd.exe' processes executing with command-line arguments containing 'gthread-3.6.dll', '\Windows\Temp\tmp.bat', or 'sigcmm-2.4.dll'. This indicates the use of specific tools and techniques employed by the Winnti threat group, as emulated by RedMimicry.
Detects the execution of the hacktool SafetyKatz, which is used for credential dumping, by identifying its executable name, original file name, or description in process creation events.
Page 560 of 680