SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,737 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the usage of "cmdkey.exe" with the '-g', '-u', and '-p' command-line arguments to add new generic credentials. This activity can be used by adversaries to store credentials for later use, potentially before connecting to remote services like RDP.
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag, where the script is located in a potentially suspicious directory such as temporary folders or user application data directories. This behavior is often associated with defense evasion and system recovery inhibition by adversaries.
This rule detects the use of 'esentutl.exe' with specific command-line arguments to extract browser data, particularly from the Windows WebCache. This activity is associated with malware like Qbot, which uses this technique to steal sensitive information from browsers such as Internet Explorer and Microsoft Edge.
Detects the expansion or decompression of cabinet files using 'expand.exe' from potentially suspicious or uncommon locations. This activity has been observed in attacks such as those related to Iranian MeteorExpress and Konni malware.
This rule detects the creation of self-extracting packages using iexpress.exe when the Self Extraction Directive (SED) file is located in potentially suspicious directories such as ProgramData, Temp, or Windows Tasks folders. This activity has been observed in-the-wild by various threat actors for defense evasion and payload delivery.
This rule detects the execution of msiexec.exe attempting to load a DLL and call its DllUnregisterServer function. This behavior is often abused by adversaries for defense evasion and proxy execution, as msiexec.exe is a legitimate Windows utility. The detection specifically looks for msiexec.exe being executed with the '-z' flag and a command line containing '.dll', indicating an attempt to unregister a DLL.
Detects attempts to disable the Windows Recovery Environment (WinRE) using the `reagentc.exe` command-line tool with the `/disable` argument. Disabling WinRE can prevent system recovery and troubleshooting, which is a common tactic used by adversaries to hinder incident response and recovery efforts.
Detects when 'CertOC.exe' is used to load a DLL, which can be an indicator of System Binary Proxy Execution. Adversaries may abuse trusted Microsoft-signed binaries like CertOC.exe to bypass defenses and execute malicious code.
Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands, as seen in the Follina (CVE-2022-30190) vulnerability. The rule specifically looks for execution of msdt.exe combined with command-line arguments indicative of arbitrary command execution, either through an inline command or by specifying an answer file.
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory. This tool, while legitimate, can be abused by adversaries to extract sensitive information, such as credentials, from process memory. The rule specifically looks for the execution of rdrleakdiag.exe with command-line arguments indicative of memory dumping, such as '/memdmp' or 'fullmemdmp', along with output and process specification arguments.
Page 287 of 680