SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of NetSupport Client Configurator (PCICFGUI.EXE) based on its description, product name, company, and original filename. NetSupport is a legitimate remote access tool that can be abused by adversaries to establish command and control, as highlighted by the MITRE ATT&CK framework.
This rule detects the execution of ScreenConnect, a legitimate remote access tool. Adversaries often abuse such tools to establish persistent command and control (C2) channels, move laterally within a network, and maintain access to compromised systems. The detection is based on specific product and company metadata associated with the ScreenConnect executable.
Detects suspicious use of command-line tools such as curl or wget to download remote
content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by
immediate execution, indicating potential malicious activity. This pattern is commonly used
by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by
immediate execution, indicating potential malicious activity. This pattern is commonly used
by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
This rule detects the execution of software whose metadata includes the description 'University of California, Berkeley'. This string is commonly associated with the BOINC (Berkeley Open Infrastructure for Network Computing) software. While BOINC is legitimate software used for volunteer computing, its unauthorized installation or use could indicate malicious activity, such as an adversary attempting to leverage system resources for their own purposes or as part of a larger compromise.
Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could indicate an attempt to exploit CVE-2020-1048, a Windows Print Spooler elevation of privilege vulnerability, by registering a malicious printer port.
This rule detects the execution of 'mstsc.exe' (Microsoft Terminal Services Client) when it attempts to open a local RDP file located in suspicious directories. Adversaries may place RDP files in these locations to establish remote desktop connections, potentially for persistence, lateral movement, or command and control. The rule specifically looks for 'mstsc.exe' being executed with a command line argument ending in '.rdp' or '.rdp"' and containing paths commonly associated with temporary files, public user folders, or system directories that are not typical for legitimate RDP file storage.
This rule detects attempts to hijack the Amazon SSM Agent by monitoring process creation events for the 'amazon-ssm-agent.exe' executable when it is launched with specific command-line arguments: '-register', '-code', '-id', and '-region'. This combination of arguments is indicative of an attacker attempting to register a compromised SSM Agent with a new AWS account or region, effectively turning it into a remote access trojan (RAT) as described in the referenced Mitiga research.
Detects the execution of "RegAsm.exe" without any command-line flags or specified files. This behavior is unusual for legitimate use of RegAsm.exe, which typically registers .NET assemblies or displays help information. Such execution patterns can indicate an attempt at process injection or other forms of defense evasion by adversaries abusing a trusted Windows utility.
This rule detects when the "BitsProxy.dll" is loaded by a process that is not part of a predefined list of legitimate system or application processes. The "BitsProxy.dll" is associated with the Background Intelligent Transfer Service (BITS) COM instance or API. Detecting its loading by uncommon processes can indicate suspicious activity, potentially related to adversaries abusing BITS for various purposes such as persistence, data transfer, or command and control.
This rule detects the execution of the GoToAssist remote access tool by looking for specific product and company metadata associated with the process. Adversaries often use legitimate remote access software like GoToAssist to establish command and control over compromised systems, blending in with normal IT support activities.
Page 313 of 680