SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when an internet-hosted WebDAV share is mounted using the `net.exe` or `net1.exe` utility. This activity can be indicative of an adversary attempting to establish remote access or exfiltrate data by mounting a remote share.
Detects when a network share is mounted using the "net.exe" or "net1.exe" utility with the 'use' command, indicating potential lateral movement or data access activity.
Detects the usage of the PowerShell '::FromBase64String' cmdlet within a process command line, specifically looking for both direct string and UTF-16 LE encoded variations. This technique is commonly used by adversaries to deobfuscate or decode base64 encoded strings, often containing malicious payloads, within PowerShell scripts.
Detects base64 encoded PowerShell commands that use 'Add-MpPreference' or 'Set-MpPreference' cmdlets to modify or tamper with Windows Defender Antivirus settings. This is a common technique used by adversaries to disable or reduce the effectiveness of endpoint security solutions.
This rule detects the execution of PowerShell scripts where the script content is provided via a redirected input stream. This technique is often used by adversaries to execute malicious PowerShell code without writing it to a file, which can help evade detection. The rule specifically looks for PowerShell or pwsh executables being run with a command line containing '- <', which signifies input stream redirection.
Detects the execution of PowerShell scripts from user-specific AppData directories (Local or Roaming). This behavior is often indicative of malware or adversary activity attempting to evade detection by running scripts from less common or user-writable locations, rather than standard system paths.
This rule detects the execution of Symantec CleanWipe, a utility designed to remove Symantec antivirus products. Adversaries may use such tools to disable security software as part of their defense evasion tactics. The rule identifies CleanWipe by specific executable names and command-line arguments associated with its uninstallation functions.
Detects the execution of the RunXCmd tool when it attempts to run commands with elevated privileges, specifically using the 'System' or 'TrustedInstaller' accounts. This tool is often used for privilege escalation.
Detects the execution of rundll32 where the DLL being called is stored within an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious code.
This rule detects the execution of the Ruby interpreter (ruby.exe) with the "-e" flag. This flag allows for inline execution of Ruby code directly from the command line, which can be leveraged by adversaries to execute arbitrary commands, launch reverse shells, or run malicious Ruby scripts without needing to save them to a file. This technique is often used in post-exploitation scenarios or for initial access.
Page 589 of 680