SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,730 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to unload filter drivers using the 'fltmc.exe' utility. Adversaries may unload filter drivers, which are often used by security products (like EDRs or antivirus), to impair defenses and evade detection. The rule specifically looks for 'fltmc.exe' being executed with the 'unload' command-line argument. It includes filters for known legitimate activities from Avira and ManageEngine to reduce false positives.
Detects the usage of msiexec.exe to perform a quiet installation of a package from a remote location (either HTTP/HTTPS or a UNC path). This behavior is often associated with malware distribution, including the Raspberry Robin worm, to evade detection and establish persistence.
Detects the usage of the "Squirrel.exe" or "Update.exe" binaries to execute arbitrary processes, often seen with Electron-based applications like Slack, Teams, and Discord. This technique can be abused by adversaries for defense evasion and execution.
This rule detects the creation of processes where the command line or image path explicitly references the 'Sysnative' folder (e.g., 'C:\Windows\Sysnative\'). This behavior is often observed in malware, particularly Cobalt Strike, to bypass WoW64 file system redirection and execute 64-bit binaries from a 32-bit process. The rule includes filters to reduce false positives from legitimate applications like .NET's ngen.exe and XAMPP's use of cmd.exe within Sysnative.
Detects when a mounted network share is removed using PowerShell cmdlets such as 'Remove-SmbShare' or 'Remove-FileShare'. This activity can be an indicator of an adversary cleaning up traces of their operations.
Detects attempts to change the PowerShell script execution policy to a less secure level (Bypass or Unrestricted) using the '-ExecutionPolicy' flag. This can be abused by adversaries to execute unsigned or malicious scripts.
Detects the creation of a new kernel driver service using 'sc.exe'. This activity can be indicative of persistence or privilege escalation attempts by adversaries, as kernel drivers operate with high privileges. The rule specifically looks for 'sc.exe' commands that include 'create' or 'config' along with 'binPath', 'type', and 'kernel' parameters. It includes filters for known legitimate Avira driver installations to reduce false positives.
Detects the creation of suspicious child processes, such as common scripting or living-off-the-land binaries (LOLBINs), originating from applications located within the WindowsApps directory. This activity could indicate the execution of malicious '.appx' packages or other forms of code execution from an unexpected and potentially untrusted source.
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc., and connects to a web application over http(s). This could indicate a possible phishing attempt, where a malicious document is used to redirect a user to a malicious website.
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection, which is a defense evasion technique.
Page 274 of 680