SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,497 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects suspicious execution of PowerShell or Command Prompt (cmd.exe) processes where the parent process is MsiExec.exe and the command line contains '-Embedding'. This behavior is often abused by adversaries to proxy the execution of malicious payloads, leveraging msiexec.exe as a trusted binary to bypass application controls.
Detects the usage of Microsoft Publisher (MSPUB.exe) to download arbitrary files from remote locations (FTP, HTTP, HTTPS). This technique can be abused by adversaries to bypass application control and execute malicious content.
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE. This rule identifies attempts to enumerate local or domain groups and accounts, specifically looking for commands that list members of sensitive groups like 'domain admins' or 'enterprise admins', or general account information. It filters out commands that are used to add users or groups to reduce false positives. The rule also includes checks for common administrative group names in multiple languages.
Detects the creation of local user accounts using the `net.exe` or `net1.exe` command-line utility with the `expires:never` option, which indicates that the account password will not expire. This is a common technique used by adversaries to establish persistent access.
Detects the addition of a new rule to the Windows firewall using the 'netsh.exe' command-line utility. This activity can indicate an adversary attempting to bypass network controls for C2 communications, lateral movement, or data exfiltration.
This rule detects the execution of the `netsh.exe` utility to configure a port forwarding rule specifically for RDP (port 3389). This technique can be used by adversaries to bypass network restrictions and establish RDP tunnels for lateral movement or command and control.
Detects a suspicious PowerShell download cradle that leverages nslookup to extract payloads from DNS TXT records. This technique is often used for defense evasion by adversaries to retrieve malicious code or data over DNS.
This rule detects the execution of 'odbcconf.exe' with the 'REGSVR' flag to register a new DLL. This technique is often abused by attackers to install and run malicious DLLs, similar to how 'regsvr32.exe' is used. The detection specifically looks for the 'odbcconf.exe' image and command-line arguments containing both 'REGSVR ' and '.dll'.
Detects the execution of "odbcconf.exe" with the "REGSVR" action where the DLL specified in the command line does not contain a ".dll" extension. This technique is often used by adversaries to evade defenses by registering malicious DLLs without the typical file extension.
This rule detects the execution of any program from the Outlook temporary files folder, which is often used by adversaries to drop and execute malicious payloads received via email. This activity is highly suspicious as legitimate applications typically do not execute from this location.
Page 563 of 680