SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,760 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of shell programs (bash, dash, fish, sh, zsh) using the 'nice' utility on Linux systems. This behavior can be indicative of an adversary attempting to escalate privileges, execute unauthorized commands, or break out of restricted environments by manipulating process priority.
Detects the execution of the "chflags" utility with the "hidden" flag on macOS. When this flag is set on a file or directory, it becomes invisible to default file listing commands and graphical file browsers, a common technique used by adversaries for defense evasion.
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects the execution of the `hdiutil` utility on macOS to mount disk images. This activity can be associated with malware delivery, as adversaries often use disk images (.dmg files) to distribute malicious payloads. Monitoring this utility can help identify suspicious attempts to introduce or execute malware on a system.
Detects when a process attempts to delete its own executable file. This action is often difficult to perform directly and can be a tactic used by malware to remove its traces from a compromised system, making forensic analysis harder.
Detects the execution of 'explorer.exe' to open the 'My Computer' folder, initiated by command-line interpreters like 'cmd.exe' or PowerShell. This behavior can be used by adversaries for discovery purposes, specifically to enumerate local drives and resources.
Detects attackers using tooling with bad operational security (opsec) defaults, specifically when spawning sacrificial processes like WerFault.exe, rundll32.exe, regsvcs.exe, regasm.exe, or regsvr32.exe without expected arguments. This behavior is often indicative of process injection or other malicious activities where the attacker fails to mimic legitimate process execution, making it easier to detect. Examples include Cobalt Strike's default use of rundll32.exe without arguments or the Kraken attack abusing WerFault without arguments.
Detects suspicious child processes spawned by wermgr.exe (Windows Error Reporting manager). Adversaries may abuse wermgr.exe to execute arbitrary commands or scripts, often as a method of defense evasion or privilege escalation. The rule specifically looks for common command-line utilities and scripting engines being launched as children of wermgr.exe, while filtering out known legitimate rundll32.exe activity related to WerConCpl.dll.
Detects the execution of the hdiutil utility with the 'create' argument, indicating the creation of a disk image on macOS. This activity can be associated with data staging or exfiltration techniques.
This rule detects the manual execution of a script from inside a compressed file (ZIP/RAR) on Windows. It identifies scenarios where a user interacts with a compressed file, causing a script to be extracted to a temporary directory and then executed by common scripting interpreters like cscript, wscript, powershell, pwsh, or mshta. The rule covers execution initiated by 7zip, WinRar, or the native Windows File Explorer.
Page 304 of 680