SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the built-in Windows utility `desktopimgdownldr.exe` to download remote files. This utility can be abused by adversaries as an alternative method for ingress tool transfer, similar to `certutil.exe`.
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt by adversaries to bypass parent/child relationship detection or application whitelisting rules by using Diskshadow.exe to proxy execution of other binaries like certutil.exe, powershell.exe, or rundll32.exe. This technique is often used for defense evasion and can be part of credential access or data exfiltration attempts.
Detects the execution of "dotnet-dump" with the "collect" flag, which can indicate potential process dumping of critical processes like LSASS. This tool is part of the .NET Core diagnostics and can be legitimately used for debugging, but its use to collect memory dumps of sensitive processes could be malicious.
This rule detects attempts to bypass Windows Defender by renaming a legitimate tool, specifically `procdump`, to `dump64.exe` and placing it within a Microsoft Visual Studio installation directory. This technique is often used to dump LSASS memory for credential access.
This rule detects the execution of 'format.com' with a command-line argument specifying a file system type that is not commonly used. The intent is to identify potential defense evasion activities where 'format.com' might be leveraged to load malicious DLL files or other programs by manipulating its file system handling capabilities. The rule specifically filters out common file system types like exFAT, FAT, NTFS, ReFS, and UDF, flagging any other '/fs:' argument as suspicious.
Detects the execution of arbitrary binaries or commands by leveraging the Notepad++ updater (gup.exe). This technique can be used by adversaries to bypass application whitelisting or execute malicious code under the guise of a legitimate process.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.
Detects the execution of Inveigh, a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool, by looking for its executable name, original file name, description, or specific command-line arguments indicative of its spoofing/sniffing functionality.
This rule detects the execution of PowerShell commands via `cmd.exe` where the PowerShell script is passed through standard input (STDIN) and includes obfuscation techniques. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to pipe output to `powershell.exe`, and the PowerShell command itself contains either `${input}` or `noexit` along with `Invoke-Expression` and `DownloadString` patterns, indicative of obfuscated remote code execution.
This rule detects the use of obfuscated environment variables to execute PowerShell commands via `cmd.exe`. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to set an environment variable (e.g., `SET VAR=...`) followed by a PowerShell command that leverages string formatting (`(?:{\d}){1,}\\"\s+?\-f(?:.*\)){1,}.*\"`) to reconstruct and execute code. This technique is often employed by adversaries to evade detection by security tools that might monitor for direct PowerShell execution or specific command-line patterns.
Page 576 of 680