SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,497 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of "WerFault.exe" with the "-pr" command-line flag. This specific command-line argument is used to run files stored in the ReflectDebugger registry key, which can be abused by adversaries to masquerade execution flow and achieve persistence or defense evasion by leveraging a legitimate Windows error reporting process.
Detects the execution of 'whoami.exe' with the '/groups' or '-groups' command-line flag to enumerate group membership for the current user. This activity is often performed by attackers during the discovery phase to understand the privileges of a compromised account.
Detects the execution of 'whoami.exe' with the '/priv' or '-priv' command-line flag. This command is used to display the current user's security privileges and is often executed by adversaries after a successful privilege escalation to understand their new capabilities or during discovery phases.
Detects the execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl files via winrm.vbs and a potentially renamed cscript.exe. This technique is used to bypass Application Whitelisting (AWL) by leveraging legitimate Windows scripts.
This rule detects the creation of a WMI script event consumer by monitoring for the execution of 'scrcons.exe' with 'svchost.exe' as its parent process. This specific process relationship is indicative of WMI persistence mechanisms, where a script event consumer is registered to execute code when certain WMI events occur. Adversaries often leverage WMI event consumers for persistence and privilege escalation.
Detects the execution of 'wmic.exe' with the 'qfe' flag to enumerate installed hotfix updates on a Windows system. This activity is commonly observed in penetration testing and attacker reconnaissance scripts to gather system information.
This rule detects the execution of 'wmic.exe' with command-line arguments indicating a query for service information. Adversaries may use WMIC to perform reconnaissance on remote systems, checking for the existence and status of specific services. The rule specifically looks for 'wmic.exe' or 'WMIC.exe' in the image name or original file name, combined with the presence of 'service' in the command line.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system and allows users to enable or disable individual handlers. It is extensible, allowing developers to implement and register their own disk cleanup handlers. This rule specifically looks for the creation of new registry keys under 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\' which could indicate a malicious handler being registered for persistence, while filtering out known legitimate default entries.
Detects the removal of folders from the "ProtectedFolders" list within Windows Defender Exploit Guard's Controlled Folder Access feature. This action could indicate an attacker attempting to bypass security controls to launch an encryption process, manipulate data within a protected folder, or otherwise impair defenses.
Detects when the "Index" value of a scheduled task is removed or deleted from the Windows Registry. This action effectively hides the scheduled task from standard tooling like "schtasks /query", making it a defense evasion technique.
Page 569 of 680