SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,760 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the initial execution of FakeUpdates/SocGholish malware. This rule identifies scenarios where 'wscript.exe' is used as a parent process to execute a JavaScript file from the 'AppData\Local\Temp' directory, often containing 'update' and '.zip' in its command line, and subsequently spawns 'cmd.exe' or 'powershell.exe'. The presence of browser names in the parent command line further indicates a drive-by download infection vector.
This rule detects when the user risk and multi-factor authentication (MFA) registration policy is updated within Azure Active Directory (AAD). Attackers may modify these policies to bypass MFA, weaken security thresholds, facilitate further attacks, or maintain persistence by altering how users authenticate or register for MFA.
Detects a suspicious WinRAR execution in a folder which is not the default installation folder
Detects the Emotet Epoch4 loader as reported by @malware_traffic in 2022. This specific detection focuses on the execution chain involving a .LNK file delivered via a phishing campaign, which then uses `cmd.exe` or `powershell.exe` to execute commands containing `findstr`, `.vbs`, and `.lnk` in the command line. This indicates an attempt to locate and execute a VBScript from within the LNK file context, a common technique for malware like Emotet to achieve initial execution.
Detects the execution of the BCP utility to export data from a Microsoft SQL Server database. Attackers may use this method to extract malware previously saved into a database column or table, or to exfiltrate sensitive data from the database.
This rule detects the addition of an AppX package to the processing pipeline where the package's source path contains domains commonly associated with file sharing, code hosting, or temporary storage services. Adversaries often leverage these services to host malicious payloads, including AppX packages, to bypass traditional security controls or to deliver malware. The rule specifically looks for EventID 854 from the 'AppXDeployment-Server' log source and checks if the 'Path' field contains any of the listed suspicious domains.
Detects the execution of the Doppelganger hacktool, which is designed to dump LSASS memory by cloning processes to evade common detection methods. The rule identifies this activity by looking for specific executable names or known ImpHash values associated with the Doppelganger tool.
Detects the use of GCC (or C89/C99) with the '-wrapper' option to execute a shell, which can be leveraged for privilege escalation, unauthorized command execution, or to break out from restricted environments. This technique is often documented in resources like GTFOBins.
This rule detects the execution of 'vshadow.exe' with the '-exec' parameter. The VShadow tool is used to create and manage volume shadow copies, and the '-exec' parameter allows for the execution of a specified script or command after shadow copies are created but before VShadow exits. While this functionality can be used legitimately for backup or administrative tasks, attackers can abuse it to proxy the execution of malicious code, thereby bypassing security controls or achieving defense evasion.
Detects the use of the 'find' command in Linux to execute a shell. This behavior is often associated with privilege escalation, unauthorized command execution, or exploitation attempts, particularly when leveraging misconfigurations or vulnerabilities to break out of restricted environments.
Page 302 of 680