SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,739 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious installations of IIS native-code modules via the command line using `appcmd.exe`. This activity can be indicative of an adversary establishing persistence on a web server by installing malicious components or backdoors. The rule specifically looks for `appcmd.exe` executing with `install` and `module` in the command line, along with the `-name:` parameter, while filtering out legitimate installations performed by `iissetup.exe`.
Detects the execution of `certutil.exe` with the "-encode" flag to encode a file to Base64. This rule specifically triggers when the input file is located in potentially suspicious directories such as `AppData\Roaming\`, `Desktop\`, `Local\Temp\`, `PerfLogs\`, `Users\Public\`, `Windows\Temp\`, or `$Recycle.Bin`. This activity is often indicative of defense evasion, where attackers obfuscate malicious payloads to bypass security controls or hide their activities.
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost". This technique can be used for defense evasion by obscuring the true parent process.
Detects the execution of `findstr.exe` with both the `/s` (search subfolders) and `/i` (case-insensitive search) flags. Adversaries commonly use `findstr.exe` as a living-off-the-land binary (LOLBIN) to search for sensitive information, configuration files, or other interesting data within a compromised system, often filtering through command output or file contents.
Detects the execution of 'lodctr.exe' with the '-r' flag, which is used to rebuild performance counter registry values. Attackers can abuse this utility by providing a malicious configuration file to overwrite performance counter configurations, potentially confusing or evading monitoring and security solutions.
This rule detects the execution of msiexec.exe with command-line arguments indicative of a quiet installation. Adversaries often abuse msiexec.exe, the Windows Installer command-line utility, to proxy the execution of malicious payloads. The rule specifically looks for msiexec.exe being executed with installation-related flags such as '-i', '-package', '-a', or '-j', combined with the quiet installation flag '-q'. It filters out common legitimate scenarios where msiexec.exe might be used in temporary user or system directories, or by the System Center Configuration Manager (SCCM).
Detects unknown programs attempting to escalate privileges to LOCAL SYSTEM by using command-line arguments commonly associated with tools like PsExec and PAExec. The rule specifically looks for combinations of '-s' (run as SYSTEM) and '-i' (interact with desktop) flags followed by common shell executables like 'cmd', 'pwsh', or 'powershell'. It filters out known instances of 'paexec' and 'PsExec' to avoid overlap with more specific rules.
Detects the enumeration of loaded modules or DLLs within processes using 'tasklist.exe' with the '-m' flag. This activity is often performed by attackers to identify the Process ID (PID) associated with a specific DLL (e.g., 'rdpcorets.dll') for subsequent actions like dumping process memory to extract credentials.
This rule detects the execution of the built-in Windows utility "whoami.exe" specifically when used with the "/all" flag. This command is often used by attackers during the discovery phase to gather extensive information about the current user, including user name, security identifiers (SIDs), groups, and privileges. This detailed information can help an adversary understand their current access level and plan subsequent actions.
This rule detects the use of the `curl` command-line tool to download a file from a remote HTTP/HTTPS source and immediately execute it. The detection logic specifically looks for `curl` in the command line, followed by an HTTP/HTTPS URL, the `-o` (output file) flag, and an `&` character, which often indicates command chaining for immediate execution. This behavior is commonly observed in adversaries attempting to transfer and execute malicious payloads.
Page 289 of 680