SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,732 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when the Microsoft Management Console (MMC) loads scripting engine DLLs such as vbscript.dll, jscript.dll, or jscript9.dll. This activity can indicate an attempt to execute malicious scripts within a trusted system process, potentially for bypassing application whitelisting or defense evasion.
Detects the presence of the "u202+E" character in command lines, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This technique is used for obfuscation and masquerading to make malicious files appear benign.
Detects the use of PowerShell cmdlets (`Get-LocalGroup`, `Get-LocalGroupMember`) or WMI queries (`Get-WmiObject`, `Get-CimInstance` targeting `Win32_Group`) to gather local group information. Adversaries commonly use these methods to discover local system permission groups and identify users with elevated privileges, such as local administrators.
Detects the removal of a port or application rule in the Windows Firewall configuration using netsh
Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
Detects the execution of CoercedPotato, a tool used for privilege escalation. The rule specifically looks for the executable name 'CoercedPotato.exe', the command-line argument '--exploitId', or specific import hashes (IMPHASH) associated with the tool. This tool leverages vulnerabilities to achieve higher privileges on a system.
Detects suspicious calls to the "ShellExec_RunDLL" exported function of SHELL32.DLL using an ordinal number to launch other commands. Adversaries might use ordinal numbers to bypass detections that rely on the function name in the command line. The rule looks for specific ordinal numbers associated with ShellExec_RunDLL and combines this with suspicious parent command-line arguments (e.g., containing 'comspec', 'iex', 'Invoke-', or paths like 'Temp') or suspicious child processes (e.g., bash, cmd, powershell, bitsadmin, msiexec).
Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer.
LaZagne has been leveraged multiple times by threat actors in order to dump credentials.
LaZagne has been leveraged multiple times by threat actors in order to dump credentials.
Detects Windows executables that write files with suspicious extensions
Page 278 of 680