SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,720 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the image load of 'vsstrace.dll' by executables that are not typically associated with legitimate Windows operations or known backup solutions. This behavior can indicate an adversary attempting to manipulate or delete Volume Shadow Copies, often as a precursor to data encryption for impact (ransomware) or to hinder system recovery.
This rule detects common PowerShell download and execution cradles. It looks for command-line arguments that indicate an attempt to download content from the internet (e.g., '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', 'Invoke-RestMethod', 'irm') combined with immediate execution (e.g., ';iex $', '| IEX', 'Invoke-Expression'). These patterns are frequently used by adversaries to fetch and execute malicious scripts or payloads directly in memory.
This rule detects the execution of WinRAR (rar.exe or winrar.exe) from a directory that is not its standard installation path (e.g., 'Program Files\WinRAR'). It specifically excludes 'UnRAR.exe' executions and also filters out executions from the Windows temporary directory ('Windows\Temp') to reduce false positives. This behavior can be indicative of an adversary using a portable or custom-dropped version of WinRAR for archiving data prior to exfiltration, or for other malicious purposes.
This rule detects the usage of the 'ssh.exe' binary as a proxy to launch other programs. This technique can be abused by adversaries for defense evasion and to execute arbitrary commands. The detection specifically looks for 'ssh.exe' being spawned by 'sshd.exe' or for 'ssh.exe' command lines containing 'ProxyCommand=' or 'PermitLocalCommand=yes' and 'LocalCommand'.
Detects the execution of Python web servers via command line interface (CLI).
After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.
This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.
After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.
This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
This rule detects the use of alternate PowerShell hosts, which adversaries might leverage to bypass security detections that specifically monitor 'powershell.exe'. It identifies PowerShell module loads where the 'ContextInfo' field does not correspond to standard PowerShell executables or known legitimate applications that host PowerShell, such as sdiagnhost.exe, ConfigSyncRun.exe, dsac.exe, or wsmprovhost.exe. The rule also filters out common PowerShell help update activities.
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors
Detects the creation of scheduled tasks that involves a temporary folder and runs only once
Page 256 of 680