SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,760 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of 'bitsadmin.exe' to download files from domains commonly associated with file-sharing services or attacker-controlled infrastructure. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
Detects the execution of 'certutil.exe' with specific command-line flags ('urlcache' or 'verifyctl') used to download files from known file-sharing or content delivery websites. This technique is often leveraged by adversaries to transfer malicious tools or payloads into a compromised environment, bypassing traditional security controls.
Detection rule generated by AI system
Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. These tools leverage Windows Server Update Services (WSUS) to achieve lateral movement, often by injecting malicious payloads or approving updates to distribute malware. The rule specifically looks for command-line arguments indicative of these tools' operations, such as '-Inject', '-PayloadArgs', '-PayloadFile' for WSUSpendu, and 'approve', 'create', 'check', 'delete', '/payload:', '/updateid:' for SharpWSUS.
Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.
This rule detects attempts to disable antivirus filter drivers on a "Dev Drive" by setting the 'FltmgrDevDriveAllowAntivirusFilter' registry value to '0x00000000'. This action prevents antivirus mini-filters from inspecting the Dev Drive, potentially allowing malicious activity to go undetected.
This rule detects the execution of "wusa.exe" (Windows Update Standalone Installer) when its parent process is located in suspicious directories. Attackers may leverage wusa.exe to bypass User Account Control (UAC) and elevate privileges by duplicating its access token. The suspicious parent process locations include common temporary directories, public user folders, and specific user profile subdirectories like Favorites, Favourites, Contacts, and Pictures.
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
Page 305 of 680