SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,743 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse this feature to establish a reverse shell or persistence on a machine.
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide a user account from being listed on the logon screen. This is a defense evasion technique used by adversaries to maintain stealth.
Detects the usage of "reg.exe" to tamper with various Windows Defender registry keys. This tampering aims to disable important features related to protection and detection, such as real-time monitoring, cloud protection, tamper protection, and other security functionalities. The rule specifically looks for `reg.exe` commands adding or modifying DWORD values to '0' or '1' for known Windows Defender settings.
This rule detects the installation of VirtualBox drivers or the initiation of VirtualBox virtual machines. Adversaries, particularly ransomware groups like Ragnar Locker and Maze, have been observed using virtual instances to execute malicious operations, thereby evading detection by security tools on the host system. The rule specifically looks for command-line arguments related to VirtualBox driver components (VBoxRT.dll, VBoxC.dll, VBoxDrv.sys) or commands used to start/control virtual machines ('startvm', 'controlvm').
This rule detects the creation of a Volume Shadow Copy using PowerShell, specifically looking for the `Win32_ShadowCopy` WMI class and the `.Create()` method with the `ClientAccessible` parameter. Adversaries often use Volume Shadow Copies to access or copy the Active Directory domain database (NTDS.dit) to steal credential information, or other sensitive data from the local system.
Detects the execution of REGSVR32.exe with DLL files masquerading as other files
Detects network connections to domains associated with BTunnels, a service that can be abused by attackers to establish reverse shells or persistence on a machine. The rule specifically looks for outbound connections where the destination hostname ends with '.btunnel.co.in'.
Detects the use of MeshAgent to execute commands on the target host, specifically when it spawns command-line interpreters like cmd.exe, powershell.exe, or pwsh.exe. This behavior can be abused by threat actors to execute arbitrary commands directly on a compromised system, potentially leveraging MeshAgent's capabilities to obscure activities.
Detects a Chromium-based browser process being launched with the '--load-extension=' command-line flag. This flag allows an instance of the browser to be started with a custom extension, which can be abused by adversaries for persistence, data exfiltration, or other malicious activities. This technique is often associated with malware like ChromeLoader.
Detects a suspicious process spawning a Chromium-based browser process with the '--load-extension' flag to start an instance with a custom extension. This technique is often used by adversaries to establish persistence or execute malicious code within the browser environment.
Page 294 of 680