SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of the UltraViewer remote access tool. UltraViewer is a legitimate desktop support software that can be abused by adversaries to establish an interactive command and control channel to target systems. Detection is based on specific product, company, or original filename attributes associated with UltraViewer.
This rule detects the execution of AnyDesk, a legitimate remote access tool. Adversaries often abuse such tools to establish command and control (C2) channels to target systems, as they are commonly allowed by application control and can blend in with normal network traffic. The detection logic looks for specific image names, descriptions, product names, or company names associated with AnyDesk during process creation events.
Detects the piping of a password to an AnyDesk instance via the command line using the '--set-password' flag. This technique can be used by adversaries to programmatically set a password for AnyDesk, potentially for remote access.
This rule detects the execution of LogMeIn Guardian Service (LMIGuardianSvc) based on its description, product name, or company name. LogMeIn is a legitimate remote access tool that can be abused by adversaries to establish command and control over compromised systems. The rule specifically looks for process creation events where the 'Description' or 'Product' field contains 'LMIGuardianSvc' or the 'Company' field is 'LogMeIn, Inc.'.
This rule detects the execution of AnyDesk, a legitimate remote access tool, from suspicious folders. Adversaries often use such tools to establish command and control channels. The rule specifically looks for AnyDesk executables (AnyDesk.exe or AnyDeskMSI.exe) that are not located in standard installation paths like 'Program Files' or 'AppData'.
Detects potential execution of MeshAgent which is a tool used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Detects the execution of mshta.exe with command-line arguments that include file extensions not typically associated with HTML Application (HTA) content, such as image files (.png, .jpg), archives (.zip), documents (.pdf), and others. This behavior is often indicative of adversaries abusing mshta.exe, a legitimate Windows utility, to execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in Windows Server 2025 Active Directory environments. Successful usage of this tool can let attackers gain domain admin privileges by exploiting the BadSuccessor vulnerability.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects the use of command-line tools such as 'scp', 'rsync', and 'sftp' that are commonly used to copy files to or from remote systems. This activity can be indicative of an adversary transferring tools into an environment (Ingress Tool Transfer) or moving files laterally within a compromised network (Lateral Tool Transfer). The rule specifically looks for the presence of these tool names followed by a space and then a colon or an '@' symbol, which are characteristic of remote file operations.
Page 314 of 680