SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...). This technique can be used for defense evasion and execution of malicious code.
Detects modifications to Windows service paths using the 'sc.exe' utility to point to suspicious executables or common adversary-used paths. This activity can indicate an attempt to establish persistence or escalate privileges by altering how a service executes.
Detects the use of the WMI class "Win32_NTEventlogFile" with methods that can be used to manipulate event logs, such as deleting, backing up, or changing permissions. This activity, especially when originating from a PowerShell script, can be indicative of an adversary attempting to evade detection or inhibit system recovery.
This rule detects the use of Windows 8.3 short names in command-line arguments. Adversaries may use this technique to obfuscate their commands and evade detection by security tools that rely on full file paths or specific keywords. The rule specifically looks for patterns like '~1.exe', '~1.bat', etc., which are indicative of short name usage. This can be a defense evasion technique.
This rule detects attempts to discover private key files using command-line tools such as `cmd.exe`, `powershell.exe`, or `findstr.exe`. It specifically looks for commands that include common private key file extensions like .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, and .asc. This activity is indicative of an adversary searching for insecurely stored credentials on a compromised system.
Detects a Windows service binary being created or executed from suspicious directories that are commonly used by adversaries for defense evasion or persistence. The rule specifically looks for processes whose parent is 'services.exe' or 'svchost.exe' and whose image path contains known suspicious user-writable or system-specific directories.
Detects the execution of 'control.exe' as a child process of 'WorkFolders.exe', specifically when 'control.exe' is not launched from its default system directory. This behavior can indicate an attempt to bypass security defenses by proxying execution through a trusted Windows binary.
Detects the execution of the `wmic.exe` utility with the `computersystem` flag to gather information about the machine, such as domain, username, and model. This activity is often performed by adversaries during the discovery phase to understand the environment.
Detects the usage of wmic.exe to start or stop a Windows service. This activity can be indicative of an adversary attempting to manipulate system services for various malicious purposes, such as persistence, privilege escalation, or defense evasion. While wmic.exe is a legitimate system tool, its use to control services should be monitored, especially when originating from unusual processes or user contexts.
Detects suspicious activity involving the Windows Update Agent (wuauclt.exe) where the process is executed without any command-line arguments. This behavior can be indicative of an adversary attempting to masquerade malicious activity by abusing a legitimate system utility.
Page 590 of 680