SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,739 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the use of 'Rpcping.exe' to force NTLM authentication by sending an RPC test connection to a target server. This technique can be used by attackers to capture NTLM hashes, which can then be cracked offline to obtain user credentials.
This rule detects the execution of commands that include the ' -accepteula' flag. This flag is commonly used by Sysinternals tools to automatically accept their End User License Agreement (EULA), allowing for non-interactive execution. The presence of this flag in a command line can indicate the use of Sysinternals utilities, which are legitimate administrative tools but are also frequently leveraged by adversaries for various post-exploitation activities.
Detects the execution of certutil.exe with the "-decode" or "-decodehex" flags to decode base64 or hex encoded files. This technique is commonly abused by attackers to deobfuscate and prepare encoded payloads for execution, often as part of defense evasion tactics.
Detects the execution of certutil.exe with the "-encode" flag to encode a file to base64, specifically when the file has a suspicious extension. This activity can be indicative of an adversary attempting to obfuscate malicious files or exfiltrate data.
This rule detects suspicious execution of msiexec.exe with the '-y' or '/y' flag, which can be abused to execute arbitrary DLLs. Adversaries may use this technique to bypass application control or proxy execution of malicious payloads. The rule filters out known legitimate uses by Apple Bonjour and Apple Software Update, as well as Microsoft System Center Configuration Manager (SCCM).
Detects the execution of 'odbcconf.exe' with the '-f' flag to load a response file that does not have a '.rsp' extension. This behavior is suspicious as it deviates from the typical use of odbcconf.exe and can be leveraged by adversaries for defense evasion, specifically to proxy execution of malicious payloads.
Detects the export of a target Registry key to a file using 'regedit.exe' with the '-E' command-line argument. This rule specifically filters out common critical keys (HKLM\SYSTEM, HKLM\SAM, HKLM\SECURITY) to reduce false positives and focus on other potentially malicious registry exports.
Detects the execution of a renamed ProcDump executable. This is often done by attackers or malware in order to evade defensive mechanisms. The rule looks for processes with an original filename of 'procdump' or command-line arguments indicative of ProcDump usage (e.g., '-ma', '-mp', '/accepteula'), while filtering out executions where the image name is still 'procdump.exe' or 'procdump64.exe'.
This rule detects suspicious activity involving `CertOC.exe` loading a DLL from unusual or temporary paths. `CertOC.exe` is a legitimate Windows binary used for certificate operations, but it can be abused to load arbitrary DLLs, a technique often used for defense evasion or privilege escalation. The rule specifically looks for `CertOC.exe` being executed with the `-LoadDLL` command-line argument, combined with the DLL path being located in common temporary or user-writable directories like `AppData\Local\Temp`, `Desktop`, `Downloads`, `Users\Public`, `C:\Windows\Tasks`, or `C:\Windows\Temp`.
Detects the execution of 'ftp.exe' with the '-s' or '/s' flag, which indicates script execution, or any child processes spawned by 'ftp.exe'. This behavior can be abused by adversaries for arbitrary command execution, often as a method of defense evasion or indirect command execution.
Page 288 of 680