SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects PowerShell command-line obfuscation techniques specifically associated with 'COMPRESS OBFUSCATION' often used by tools like Invoke-Obfuscation. This method typically involves compressing data and decompressing it in memory using .NET classes like `System.IO.Compression.DeflateStream` and `System.IO.StreamReader` combined with `new-object` and `text.encoding]::ascii`.
Detects obfuscated PowerShell execution via standard input (stdin) in scripts. This technique is often used by adversaries to evade detection by security tools that might inspect command-line arguments.
This rule detects the execution of 'hxtsr.exe' from an unexpected file path. HxTsr.exe is a legitimate Microsoft Outlook Communications component typically found within a hidden 'WindowsApps' subfolder of 'C:\Program Files'. If 'hxtsr.exe' is executed from any other location, it could indicate malware attempting to masquerade as a legitimate process to evade detection.
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Detects potential abuse of the "register_app.vbs" script, which is part of the Windows SDK. This script can register new VSS/VDS Providers as COM+ applications. Attackers may leverage this functionality to install malicious DLLs for persistence and execution.
This rule detects the execution of 'wfc.exe', the Workflow Command-line Compiler. This utility is known to be used for Application Whitelisting (AWL) bypasses and is listed in Microsoft's recommended block rules for applications that can bypass Windows Defender Application Control (WDAC). Detection of this executable could indicate an attempt to bypass security controls or execute unauthorized code.
This rule detects the creation of child processes by 'Mftrace.exe', which is a legitimate Windows utility (Trace log generation tool for Media Foundation Tools). Adversaries can abuse 'Mftrace.exe' to execute arbitrary binaries, effectively bypassing application whitelisting or other security controls by proxying execution through a trusted process. The rule specifically looks for any process that has 'mftrace.exe' as its direct parent.
This rule detects the execution of 'mshta.exe' with command-line arguments containing URL schemes like 'http://', 'https://', or 'ftp://'. This behavior is indicative of an attacker attempting to execute a remotely hosted HTML Application (HTA) file, which can be used for malicious purposes such as code execution or bypassing security controls. Attackers often leverage mshta.exe as a living-off-the-land binary (LOLBIN) to execute scripts or download additional payloads from remote servers.
Detects a potential LethalHTA technique where 'mshta.exe' is spawned by an 'svchost.exe' process. This parent-child relationship is unusual and can indicate the abuse of mshta.exe for code execution, often bypassing application controls.
This rule detects the execution of 'MSOHTMED.exe' when its command line contains URL indicators such as 'ftp://', 'http://', or 'https://'. MSOHTMED.exe is a legitimate Microsoft Office component (HTML Editor) that can be abused to download arbitrary files from the internet, acting as a living-off-the-land binary (LOLBIN). This behavior can be used by adversaries for defense evasion and execution of malicious content.
Page 588 of 680