SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potentially suspicious child processes spawned by Wscript.exe or Cscript.exe. This includes scenarios where these script hosts launch command-line interpreters (cmd.exe, powershell.exe) that then execute tools like rundll32, regsvr32, msiexec, or mshta with network-related arguments. It also covers direct spawning of rundll32.exe by Wscript/Cscript, while filtering out common legitimate uses of rundll32. This behavior is often observed in malware such as Pikabot and Qakbot for execution and defense evasion.
Detects the execution of the "pbpaste" utility on macOS. This utility retrieves the contents of the clipboard and writes them to standard output. Attackers can abuse this utility to collect sensitive data, such as passwords or other confidential information, from the user's clipboard. The rule is designed to hunt for potential malicious use of pbpaste by examining the parent process and command-line arguments for suspicious activity.
Detects when Kubernetes Secrets are created, modified, or deleted. This activity is critical to monitor as secrets often contain sensitive information like API keys, passwords, and OAuth tokens. Unauthorized modification or deletion of these secrets could lead to credential compromise, unauthorized access, or denial of service within a Kubernetes cluster.
Detects the execution of "aspnet_compiler.exe" when it attempts to compile files from potentially suspicious or user-writable directories. This behavior can indicate an adversary using a trusted developer utility for defense evasion or to execute malicious code.
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics such as image name, original file name, or description containing 'Crassus'. This tool is used for reconnaissance and discovery activities on a compromised system.
Detects the execution of 'TruffleSnout.exe', a tool designed for iterative Active Directory discovery, situational awareness, and targeted low-noise enumeration. This rule identifies the tool by its original filename or by the executable's image path ending with 'TruffleSnout.exe'.
Detects potential command-line obfuscation using Unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This rule specifically looks for the use of various Unicode characters that can be used to obscure commands executed by common Windows command-line interpreters and scripting engines.
Detects the execution of AddInUtil.exe, a legitimate Microsoft utility for updating Add-In deployment caches, from a directory that is not a standard Microsoft .NET Framework or WinSxS location. Adversaries may abuse this utility to proxy execution of malicious code, bypass application whitelisting, or evade defenses.
This rule detects suspicious process creation patterns that may indicate FIN7 exploitation activity. Specifically, it looks for `cmd.exe` being spawned by `notepad++.exe` or `notepad++.exe` being spawned by `rdpinit.exe`. These process relationships are indicative of potential post-exploitation actions after initial access, possibly via compromised RDP credentials as described in the referenced Google blog.
Detects the use of the PowerShell cmdlet 'Get-StorageDiagnosticInfo' with the '-IncludeLiveDump' parameter to dump the live memory of a Windows machine. This technique can be used by adversaries to extract sensitive information, including credentials, from memory.
Page 324 of 680