SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the WMI class "Win32_NTEventlogFile" within a PowerShell script to perform suspicious actions such as deleting, backing up, changing permissions, renaming, or taking ownership of event logs. This activity is often associated with defense evasion tactics by adversaries attempting to remove forensic evidence or impair system defenses.
This rule detects the use of WMImplant, a PowerShell-based post-exploitation tool that leverages Windows Management Instrumentation (WMI) for various malicious activities. It specifically looks for keywords and function names associated with WMImplant's capabilities within PowerShell script block logs, such as 'WMImplant', 'change_user', 'command_exec', 'disable_wdigest', 'enable_winrm', 'registry_mod', 'remote_posh', 'sched_job', 'service_mod', 'process_kill', 'active_users', 'basic_info', 'power_off', 'vacant_system', and 'logon_events'. Detection requires PowerShell Script Block Logging to be enabled.
Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.
Detects the usage of bitsadmin.exe to download files to uncommon target folders such as AppData or Temp directories. This technique is often used by adversaries for ingress tool transfer or to stage malicious payloads.
Detects the execution of common browser processes (Brave, Chrome, Edge, Opera, Vivaldi) with a command-line argument containing a URL that points to a file with a potentially interesting extension. This behavior can be abused by adversaries to download arbitrary files, potentially for further execution or to hide malicious activity by launching the browser in a minimized state.
Detects suspicious command line execution by `cmd.exe` that includes both a URL (http or https) and the `%AppData%` environment variable in its parameters. This pattern is often observed in droppers, particularly those using JavaScript or VBScript to execute PowerShell commands.
Detects the execution of the built-in "rmdir" command in Windows to delete directories. This activity can be used by adversaries to remove traces of their intrusion activity, such as malware, tools, or other non-native files, to minimize their footprint on a system.
This rule detects the execution of 'curl.exe' to download files from a direct IP address, rather than a domain name. It specifically looks for command-line arguments that indicate a download operation (e.g., '-O', '--remote-name', '--output') and the presence of an IP address in the URL. The rule also filters for common executable and script file extensions, suggesting the download of malicious payloads. This activity is often associated with adversaries attempting to retrieve tools or malware onto a compromised system, bypassing typical domain-based reputation checks.
Detects attempts to unload the Sysmon filter driver using 'fltmc.exe'. This activity is often indicative of an adversary trying to impair defenses and remove forensic evidence by disabling Sysmon's monitoring capabilities.
This rule detects the use of Gpg4win's gpg.exe or gpg2.exe for file decryption. It specifically looks for command-line arguments that include both '-d' (for decrypt) and 'passphrase', indicating an attempt to decrypt a file using a passphrase. This activity can be indicative of malicious actors decrypting sensitive data or malware components.
Page 587 of 680