SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious Splwow64.exe process execution without any command line parameters. This behavior can be indicative of indirect command execution or defense evasion techniques where adversaries might abuse legitimate Windows processes to execute malicious code without directly invoking a command-line interpreter.
Detects cases where an ISO file is opened within an archiving application like 7-Zip or WinRAR. This behavior is often associated with phishing campaigns where threat actors embed small ISO files in archives as email attachments to bypass security filters and protective measures (e.g., Mark-of-the-Web).
Detects execution from an Alternate Data Stream (ADS) using various Windows utilities. Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. The rule specifically looks for command-line patterns indicative of reading from an ADS (e.g., 'txt:') combined with common tools like 'type', 'makecab', 'reg', 'regedit', or 'esentutl' that can interact with or extract data from streams.
Detects potential command-line obfuscation techniques using escape characters, specifically looking for 'h^t^t^p' or 'h"t"t"p' patterns in process command lines. This method is often used by adversaries to evade detection by security tools that might be looking for cleartext indicators like URLs.
This rule detects the execution of arbitrary shell commands via the '.SettingContent-ms' file type. These files, introduced in Windows 10, are XML-based shortcuts to Windows settings pages. Adversaries can manipulate these files to execute malicious commands, bypassing typical execution controls. The rule specifically looks for process creation events where the command line contains '.SettingContent-ms' and excludes legitimate calls to 'immersivecontrolpanel'.
Detects the use of Windows 8.3 short names in process images, which can be leveraged by adversaries as a defense evasion technique to bypass image-based detections. This rule specifically looks for common executable and script file extensions preceded by '~1' or '~2' in the Image path.
Detects the execution of script interpreters (cscript.exe, mshta.exe, wscript.exe) with suspicious command-line flags or from temporary folders or folders accessible by environment variables, which is a common technique used by adversaries for execution and persistence.
This rule detects the execution of LiveKD, a Sysinternals tool, based on its executable name or original filename metadata. LiveKD allows users to examine a live system's kernel memory, which can be abused by attackers for memory dumping activities, particularly for credential extraction.
Detects suspicious execution of 'sysprep.exe' where the command line includes a path within the 'AppData' folder. This behavior has been observed in malware like Trojan Syndicasec, as detailed in Symantec's Thrip report.
Detects the creation of taskmgr.exe process running under the LOCAL_SYSTEM account. This is an unusual and potentially malicious activity, as task manager typically runs under the user's context. This could indicate an attempt to elevate privileges or execute code with SYSTEM privileges.
Page 582 of 680