SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,739 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of "Diskshadow.exe" in script mode with a potentially uncommon script extension. This rule requires initial baselining of allowed script extensions to minimize false positives. Adversaries may use Diskshadow.exe, a legitimate Windows utility, to proxy execution of malicious scripts, often as a defense evasion technique.
Detects the use of 'replace.exe' with the '-a' argument, which is used to add new files to the destination directory. This utility can be abused by adversaries to replace or add files on a system, potentially for persistence, defense evasion, or to introduce malicious tools.
Detects the usage of the 'unregmp2.exe' binary as a proxy to launch a custom version of 'wmpnscfg.exe' by looking for the '/HideWMP' command-line argument. This technique is often used for defense evasion.
Detects the execution of 'odbcconf.exe' with the '-f' flag, indicating an attempt to load a response file. This technique can be abused by adversaries to execute malicious actions, often as a method of defense evasion or to bypass application controls.
This rule detects the execution of LiveKD, a Sysinternals tool, specifically when used with the "-m" flag. The "-m" flag is used to force a kernel memory dump, which can be leveraged by attackers for credential dumping or other forms of sensitive information extraction from the kernel memory. This activity is highly suspicious in a production environment and could indicate an attempt at defense evasion or credential access.
This rule detects attempts to uninstall Sysmon by monitoring process creation events for Sysmon executables (Sysmon64.exe or Sysmon.exe) being run with the '-u' command-line argument. This activity is often indicative of an adversary attempting to evade detection by removing security tools.
Detects the execution of "Wlrmdr.exe" with the "-u" command line flag, which allows anything passed to it to be an argument of the ShellExecute API, potentially enabling an attacker to execute arbitrary binaries. This detection also identifies uncommon child processes spawned from "Wlrmdr.exe" as a supplementary measure for environments with "ParentImage" telemetry.
Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration
Detects the execution of 'find.exe' or 'findstr.exe' with command-line arguments containing 'lsass'. This activity often indicates reconnaissance for the Local Security Authority Subsystem Service (LSASS) process ID, which is a common precursor to credential dumping attempts.
This rule detects an unusual command-line flag combination for 'regsvr32.exe'. Specifically, it looks for instances where the '/i' flag (install) is used without the '/n' flag (no UI). This combination is often indicative of malicious activity, as legitimate uses of regsvr32.exe with '/i' typically also include '/n' to suppress the user interface.
Page 290 of 680