SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of a Microsoft signed script, UtilityFunctions.ps1, executing a managed DLL with PowerShell. This technique can be used by adversaries to bypass application control and signature validation.
This rule detects the execution of 'VisualUiaVerifyNative.exe', a legitimate Microsoft Windows SDK tool. This executable has been identified as a potential method for bypassing Application Whitelisting (AWL) solutions like Windows Defender Application Control (WDAC) and is included in Microsoft's recommended block rules for such bypasses. Adversaries may abuse this signed binary to proxy execution of malicious code, thereby evading defenses.
Detects the use of Windows Defender's MpCmdRun.exe utility to download files from a specified URL. This technique can be abused by adversaries for ingress tool transfer or to bypass security controls by using a legitimate, signed Microsoft binary.
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command line, which could indicate a suspicious activity. This pattern is often observed in scripts attempting to execute commands via Windows Script Host (WSH) objects.
MsiExec Web Install
Sigma
Detects suspicious execution of msiexec.exe with web addresses as parameters, which can be indicative of an adversary attempting to download and execute malicious MSI packages or DLLs directly from a remote source. This technique is often used for defense evasion and ingress tool transfer.
Detects the execution of msiexec.exe from an uncommon directory, which can indicate an attempt to masquerade malicious activity by naming a malicious executable 'msiexec.exe' and placing it outside of its standard legitimate paths. This technique is often used for defense evasion.
Detects the usage of the "net.exe" or "net1.exe" command-line utility to start a Windows service using the "start" flag. This activity can be indicative of an adversary executing a service, potentially for persistence or privilege escalation.
Detects the stopping of a Windows service using the 'net.exe' or 'net1.exe' utility with the 'stop' command-line argument. This rule specifically looks for the execution of these utilities with the intent to terminate a service.
Detects the creation of new local user accounts using the 'net.exe' or 'net1.exe' command-line utility with the 'user add' arguments. This activity can be indicative of an adversary establishing persistence or creating accounts for lateral movement.
Detects attempts to enumerate file shares, printer shares, and sessions using the 'net.exe' or 'net1.exe' utility with the 'view' flag. This activity is often performed by adversaries for remote system discovery.
Page 578 of 680