SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,760 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects remote thread creation in uncommon target processes such as 'calc.exe', 'notepad.exe', 'mspaint.exe', 'ping.exe', 'sethc.exe', 'spoolsv.exe', 'wordpad.exe', and 'write.exe'. This activity can indicate process injection techniques used for defense evasion or privilege escalation.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
Detects PowerShell download and execution cradles.
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Detects potential PowerShell commands or code within registry run keys
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
Detects DNS queries for specific subdomains associated with the "Put.io" sharing website. This activity could indicate command and control communication, data exfiltration, or other malicious use by adversaries.
Detects potentially suspicious subprocesses such as LOLBINs spawned by web browsers. This activity could be associated with the "FileFix" social engineering technique, where users are tricked into launching the file explorer via a browser-based phishing page and pasting malicious commands into the address bar. The technique abuses clipboard manipulation and disguises command execution as benign file path access, resulting in covert execution of system utilities.
Page 301 of 680