SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,735 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
This rule detects the execution of any process that originates from the '/tmp/' directory on a Linux system. The '/tmp/' directory is often used by adversaries to stage and execute malicious payloads, as it is typically writable by all users and can be used to bypass certain security controls. The rule specifically excludes executions of '/usr/bin/nextcloud' from '/tmp/' to reduce false positives.
Detects the execution of "findstr" with specific command-line flags and a remote share path. This combination of flags allows "findstr" to download the content of a file located on a remote share, as described in the LOLBAS project. This technique can be used for ingress tool transfer or data staging.
Detects the initial execution of the Raspberry Robin malware from an external drive. The rule specifically looks for `cmd.exe` as a parent process, executing a command containing `/r` and ending with specific file extensions (like .bin, .ico, .lnk, .lo, .sv, .usb), which then launches `msiexec.exe` with `/q` and a URL (http: or https:). This pattern is indicative of Raspberry Robin's initial infection vector.
Detects the use of the 'chcp' command, typically executed from a command prompt ('cmd.exe'), to discover the system's locale or code page information. This activity is often performed by adversaries as part of host discovery to understand the system's language settings, which can influence subsequent actions.
Detects the export of critical Registry keys (SAM, SECURITY, SYSTEM) to a file using regedit.exe. This activity is often associated with credential dumping or exfiltration of sensitive system information.
Detects the execution of "taskkill.exe" with the /f (force) flag, which is used to forcefully terminate processes. This activity can be leveraged by attackers for data destruction or data encryption for impact, particularly against services like Exchange and SQL Server. The rule includes filters to reduce false positives from common installer behaviors.
Detects attempts to query system information directly from the Windows Registry using 'reg.exe' or PowerShell cmdlets like 'Get-ItemPropertyValue' or 'gpv'. The rule specifically looks for queries related to time zone, network configuration, operating system details, installed programs, Windows Defender status, existing services, and scheduled tasks.
This rule detects the use of 'esentutl.exe' to copy sensitive files containing credential data, such as the Security Account Manager (SAM) database or the NTDS.dit file. It specifically looks for command-line arguments indicative of Volume Shadow Copy operations or direct paths to known sensitive files within the 'config', 'repair', or 'windows\ntds' directories.
Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot.
Page 285 of 680