SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,497 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the built-in Windows script "gatherNetworkInfo.vbs" which is commonly used to collect network configuration details and other system information. This activity can be indicative of reconnaissance by an adversary.
This rule detects the execution of a process where the 'Image' field (representing the executable path) is not a full, absolute path. This behavior can be indicative of techniques like process ghosting or other methods used to start processes in an unorthodox way, often to evade detection. The rule specifically filters out null or empty image paths and common system processes to reduce false positives.
This rule detects the execution of 'te.exe', the Windows Test Authoring and Execution Framework (TAEF) executable. Adversaries can abuse 'te.exe' to proxy the execution of malicious scripts or binaries, such as Windows Script Components (WSC) files containing VBScript or DLLs, thereby bypassing security controls. The rule specifically looks for 'te.exe' being executed as the main image, a parent image, or identified by its original filename.
This rule detects the execution of a new process where the parent process is `vsjitdebugger.exe`, the Microsoft Visual Studio Just-In-Time Debugger. Adversaries may abuse this legitimate, signed binary to proxy the execution of malicious code, thereby evading defenses that trust signed executables. The rule includes exclusions for common legitimate child processes of `vsjitdebugger.exe` to reduce false positives.
This rule detects instances where 'svchost.exe' is spawned by an uncommon parent process. It specifically filters out common and legitimate parent processes such as 'Mrt.exe', 'MsMpEng.exe', 'ngen.exe', 'rpcnet.exe', 'services.exe', and 'TiWorker.exe', as well as cases where the parent process is null or empty. This helps to identify potential masquerading or defense evasion attempts where an adversary might try to hide malicious activity by naming their process 'svchost.exe' and having it spawned by an unusual parent.
Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses. The rule specifically looks for the execution of 'pssuspend.exe' or 'pssuspend64.exe' with 'msmpeng.exe' in the command line, which is the executable for Microsoft Defender Antivirus.
This rule detects the execution of 'tapinstall.exe', which is used to install TAP (Tunnel Adapter) drivers. While legitimate for VPN software like OpenVPN, Avast SecureLine VPN, and ProtonVPN, its execution outside of these known contexts could indicate an adversary preparing for data exfiltration using tunneling techniques. TAP drivers create virtual network interfaces, which can be leveraged to establish covert communication channels or bypass network segmentation.
Detects the use of the 'taskkill' command to terminate the 'ccSvcHst.exe' process, which is associated with Symantec Endpoint Protection. This action can disable the antivirus software due to an incorrect implementation of the protected service mechanism, allowing a SYSTEM user to kill the process and shut down the service.
Detects the use of "VMwareToolBoxCmd.exe" with the "script" and "set" flags to configure a script to run when a VM state changes. The rule specifically looks for scripts located in suspicious paths like temporary directories or Windows system directories, which could indicate an attempt at persistence or privilege escalation within a virtualized environment.
Detects the execution of 'wab.exe' (Windows Contacts) and 'wabmig.exe' (Microsoft Address Book Import Tool) when they are launched from non-default, suspicious locations. This behavior has been observed in campaigns involving the Bumblebee loader, where these legitimate Windows executables are abused for malicious purposes, often as part of defense evasion or execution tactics.
Page 568 of 680