SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,731 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.
Detect the creation of a service with a service binary located in a suspicious directory
Detects file access requests to browser credential stores by uncommon processes. This could indicate a potential attempt at credential stealing. This rule requires heavy baselining before usage to reduce false positives.
Detects the download of suspicious file types (executables, DLLs, scripts, etc.) from well-known file and paste sharing domains. The detection specifically looks for the creation of Alternate Data Streams (ADS) with a ':Zone' identifier, which indicates the file was downloaded from the internet and carries Mark-of-the-Web.
This rule detects the execution of Visual Studio Code (VS Code) tunnel functionality, particularly when the executable has been renamed. Attackers can abuse this feature to establish a command and control (C2) channel, bypassing typical network restrictions. The rule looks for command-line arguments indicative of VS Code tunnel activation, including specific arguments for accepting license terms or running as a service, and also checks for `cmd.exe` spawning the tunnel process.
Detects potential PsExec command execution on remote systems by looking for common command-line flags used by the utility, specifically 'accepteula', user credentials (' -u ', ' -p '), and a remote path (' \\'). It filters out connections to localhost.
Detects the use of curl.exe to download files from known file-sharing or code-hosting domains. This activity is often associated with adversaries staging or retrieving malicious tools and scripts. The rule specifically looks for curl.exe executing with command-line arguments indicating a download operation ('-O', '--remote-name', '--output') from a list of suspicious domains, and targeting common executable or script file extensions.
Detects the creation of new DLL files within the Notepad++ plugins directory by any process other than 'gup.exe' or the main installer. This activity could indicate an attempt to establish persistence on the system by injecting malicious plugins into Notepad++.
Detects BITS transfer jobs downloading files from known file-sharing or code-hosting domains often abused by adversaries for staging or delivering malicious payloads. This rule specifically looks for EventID 16403 in the BITS client logs, indicating a file transfer, and checks if the remote source domain matches a list of suspicious domains.
Detects suspicious new RUN key element pointing to an executable in a suspicious folder
Page 280 of 680