SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of SharpEvtMute, a hack tool designed to tamper with Windows event logs. The rule identifies the tool by its executable name, description, or specific command-line arguments used to filter or encode event log manipulation commands.
This rule detects the execution of 'InfDefaultInstall.exe' with an '.inf' file specified on the command line. This behavior is commonly abused by adversaries to proxy execution of malicious code, often to bypass application whitelisting or other security controls. The tool 'InfDefaultInstall.exe' is a legitimate Windows binary used to install INF files, but it can be leveraged to execute commands embedded within a specially crafted INF file, including SCT scripts via 'scrobj.dll'.
This rule detects attempts to change the password for the currently logged-on user using the 'ksetup.exe' utility. The detection specifically looks for the execution of 'ksetup.exe' with the '/ChangePassword' command-line argument. This activity could indicate an attacker attempting to modify user credentials on a compromised system.
Detects the execution of "ldifde.exe" to export Active Directory structure. This tool is often used by attackers to collect information about the domain for reconnaissance or exfiltration purposes. The rule specifically looks for the execution of ldifde.exe with the '-f' flag, which indicates an output file, while excluding the '-i' flag which is used for importing data.
This rule detects the execution of "LINK.EXE" with an uncommon parent process. LINK.EXE is a Microsoft incremental linker, typically bundled with Visual Studio. Other utilities like editbin.exe, dumpbin.exe, and lib.exe often hardcode calls to "LINK.EXE" without validating its path. This behavior can be exploited by an attacker to sideload a malicious binary named "link.exe" if one of these legitimate tools is executed from an unexpected location. The rule filters out known legitimate parent processes from Visual Studio installation paths to identify suspicious executions.
This rule detects when 'devtoolslauncher.exe' is executed with the 'LaunchForDeploy' command-line argument. This behavior is indicative of 'devtoolslauncher.exe' being used to proxy the execution of another binary, which can be abused by adversaries for defense evasion.
This rule detects the execution of 'diantz.exe' with command-line arguments that indicate both a remote file path (identified by '\\') and the creation of a CAB file (identified by '.cab'). This combination suggests that the 'diantz.exe' utility is being used to download a remote file and compress it into a CAB archive on the local machine. This behavior is often associated with adversaries transferring tools or data into a compromised environment.
This rule detects suspicious execution of 'extrac32.exe' when it is used to download or copy files, specifically cabinet (.cab) files, with common extraction options. Extrac32.exe is a legitimate Windows utility for extracting files from cabinet archives, but it can be abused by adversaries for ingress tool transfer or to stage malicious files.
Detects code execution where PowerShell (powershell.exe or pwsh.exe) is the parent process and its command line contains references to the Pester module, specifically when Pester is used to invoke other commands or scripts. This could indicate an adversary leveraging Pester for execution, potentially for defense evasion or to bypass security controls.
Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application. This technique can be used by adversaries for defense evasion by proxying execution of malicious content with a trusted binary.
Page 577 of 680