SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,739 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the subsequent execution of commands associated with Raspberry Robin malware. Specifically, it looks for processes where 'fodhelper.exe' is the parent process, and the child process is either 'rundll32.exe' or 'regsvr32.exe'. Additionally, the command line of the child process must contain specific strings like 'odbcconf.exe', 'regsvr', 'shellexec_rundll', and other keywords such as 'installdriver', 'setfiledsndir', or 'vkipdse', combined with specific command-line switches like '/a', '/f', or '/s'. This combination of parent-child processes and command-line arguments is indicative of Raspberry Robin's post-exploitation activities, often involving the abuse of legitimate Windows utilities for defense evasion and execution.
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that delete shadow copies on systems, which can be a defense evasion technique to prevent system recovery. The rule identifies instances where diskshadow.exe is launched with the script execution flag.
Detects the execution of the 'forfiles.exe' utility with the '/c' flag. This behavior, while legitimate, can be abused by adversaries to proxy execution of arbitrary commands or binaries, potentially bypassing application whitelisting controls. This technique is often associated with Living Off The Land Binaries (LOLBAS).
Detects a potentially suspicious one-liner command combining 'ping' and 'copy' within a 'cmd.exe' process. This combination is often used by malware for purposes such as network reconnaissance followed by data staging or exfiltration, or as a defense evasion technique by leveraging common system utilities in an unusual manner. The rule specifically looks for the presence of 'ping' and 'copy ' along with either the '-n' (count) or '-y' (yes to overwrite) flags in the command line.
This rule detects the use of PsExec or PAExec with command-line flags designed to escalate privileges to the LOCAL_SYSTEM account. Specifically, it looks for the '-s' flag, optionally combined with '-i', followed by common shell executables like 'cmd', 'powershell', or 'pwsh'. This behavior is indicative of an attempt to gain SYSTEM-level access on a Windows machine.
This rule detects the execution of `wmic.exe` with the `-format` flag, specifically looking for instances where the format specified is not one of the commonly known, legitimate WMIC output formats (e.g., List, htable, mof, xml, csv). Adversaries can abuse this functionality to load and execute malicious XSL (Extensible Stylesheet Language) files, potentially bypassing application whitelisting defenses. This technique is often referred to as "Squiblytwo" and leverages WMIC to invoke JScript or VBScript embedded within an XSL file.
Detects the execution of 'msdt.exe' with the '-cab' flag, which is indicative of suspicious diagnostic cabinet (.diagcab) files potentially leveraging CVE-2022-30190 (Follina vulnerability) to execute embedded answer files. This technique can be used for defense evasion and indirect command execution.
Detects the execution of 'certutil.exe' with the '-addstore' flag and 'root' in the command line, indicating an attempt to install a new root certificate on the system. Adversaries may use this technique to establish trust for their own certificates, bypassing security warnings when connecting to adversary-controlled web servers or for code signing.
Detects the execution of built-in Windows commands "del" or "erase" to delete files. Adversaries often delete files to remove traces of their intrusion activity, minimize their footprint, or clean up after malware execution. This rule specifically looks for `cmd.exe` executing these commands, potentially with flags like `-f` (force delete), `-s` (delete from subdirectories), or `-q` (quiet mode).
Detects a suspicious command-line pattern often used by ransomware, where the 'ping' command is used with a delay (e.g., '-n 3') to introduce a pause, immediately followed by the 'del' command with force and quiet flags ('-f -q') to delete a file. This technique is typically employed to hide the initial infection vector or other malicious files by deleting them after execution.
Page 286 of 680