SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,499 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of SharpLDAPmonitor, a tool used to monitor the creation, deletion, and changes to LDAP objects. This rule triggers on either the image name 'SharpLDAPmonitor.exe' or its original filename, combined with command-line arguments indicating user, password, and domain controller IP, which are typical for LDAP monitoring activities.
Detects the execution of the SharpImpersonation tool, which is used for manipulating tokens on Windows systems. This can occur remotely via tools like PsExec/WmiExec or interactively. The rule specifically looks for the executable name or command-line arguments indicating token manipulation techniques such as 'CreateProcessAsUserW' or 'ImpersonateLoggedOnUser', often combined with 'user:' and 'binary:' or 'shellcode:' parameters.
This rule detects the execution of ZipExec, a Proof-of-Concept (POC) tool designed to wrap binary-based tools into a password-protected zip file. It specifically looks for command-line arguments indicative of ZipExec's 'run' functionality (extracting and executing a zip file with a password) or 'delete' functionality (deleting the extracted files). The detection relies on specific strings like '/generic:Microsoft_Windows_Shell_ZipFolder:filename=', '.zip', '/pass:', '/user:' for 'run' operations, and '/delete', 'Microsoft_Windows_Shell_ZipFolder:filename=', '.zip' for 'delete' operations.
Detects the creation of a 'gbb.exe' process as a sub-process of 'Hwp.exe' (Hangul Word Processor). This behavior is highly suspicious and often indicative of exploitation attempts targeting vulnerabilities within the HWP application, leading to the execution of malicious payloads.
Detects the use of `icacls.exe` with specific command-line arguments to deny access for everyone (represented by the SID *S-1-1-0*) to a file or directory. This technique is often used by adversaries to hide malicious files by making them inaccessible to users and potentially some security tools.
Detects the use of the "appcmd.exe" utility to create or modify global URL rewrite rules within Internet Information Services (IIS). This activity is suspicious because threat actors have been observed leveraging this method to establish persistence or facilitate access to webshells by redirecting traffic or enabling specific paths.
Detects password change for the computer's domain account or host principal via "ksetup.exe", a command-line tool used to configure Kerberos settings.
Detects the execution of 'diantz.exe' with command-line arguments indicating the creation of a cabinet (.cab) file and the use of an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious data within legitimate files.
Detects the use of extrac32.exe to extract data from a cabinet (.cab) file and hide it within an Alternate Data Stream (ADS). This technique can be used for defense evasion by concealing malicious payloads.
Detects the execution of the LOLBIN (Living Off the Land Binaries and Scripts) `gpscript.exe` when it is used to execute logon or startup scripts configured in Group Policy. This rule specifically looks for `gpscript.exe` being executed with the `/logon` or `/startup` command-line arguments, while filtering out legitimate executions where `gpscript.exe` is parented by `svchost.exe` with the `gpsvc` service.
Page 561 of 680