SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,781 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of 'createdump.exe' or a renamed version of it, specifically when used to dump process memory. The rule looks for the original internal filename 'FX_VER_INTERNALNAME_STR' and command-line arguments indicative of memory dumping, such as '-u' or '--full' combined with '-f' or '--name' and a '.dmp' extension. This technique is often used by adversaries to extract credentials from processes like LSASS.
This rule detects suspicious command-line activity originating from common web server processes, indicative of web shell usage for reconnaissance and system interaction. It looks for specific utilities and command-line arguments often used by attackers to discover system information, user accounts, network configurations, and execute arbitrary commands through a compromised web server.
Detects HandleKatz, a tool designed to duplicate the LSASS process handle with specific access rights (PROCESS_DUP_HANDLE, PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_QUERY_INFORMATION) to later dump its memory without opening new handles. The detection logic focuses on the target image being 'lsass.exe', the specific granted access rights, and a suspicious call trace originating from ntdll.dll with an 'UNKNOWN' module.
Detects the use of 'createdump.exe', a legitimate Windows utility, to dump process memory. This technique is often used by adversaries to extract credentials from processes like LSASS. The rule specifically looks for the execution of 'createdump.exe' or its original filename 'FX_VER_INTERNALNAME_STR' combined with command-line arguments indicative of a memory dump operation, such as '-u', '--full', '-f', '--name', or '.dmp'.
Detects the execution of the XORDump utility, a tool used for dumping process memory, specifically targeting LSASS or using common DLLs for memory dumping like comsvcs, dbghelp, or dbgcore. This activity is indicative of credential access attempts.
Procdump Execution
Sigma
Detects the execution of the SysInternals Procdump utility. Procdump can be used by adversaries to dump process memory, including sensitive processes like LSASS, for credential access.
Detects the execution of 'DumpMinitool.exe', a tool used to dump process memory, specifically targeting the 'MiniDumpWriteDump' function. This tool can be used to extract credentials from processes like LSASS.
Detects suspicious execution of 'DumpMinitool.exe', a binary that can be used for credential dumping. The rule looks for executions outside of typical Visual Studio directories, or executions with command-line arguments indicative of memory dumping (e.g., '.txt', 'Full', 'Mini', 'WithHeap') unless the '--dumpType' flag is also present, which might indicate legitimate usage.
This rule detects potential attempts to steal browser data by monitoring process creation events for specific command-line utilities (copy, move, xcopy, robocopy, esentutl) combined with paths commonly associated with web browser user data directories. Adversaries often acquire credentials from web browsers by copying or moving these files, which may contain saved usernames and passwords.
This rule detects the execution of known Proof-of-Concept (PoC) executables for the ZeroLogon vulnerability (CVE-2020-1472). It specifically looks for `cmd.exe` spawning executables named `cool.exe` or `zero.exe` with command-line arguments indicating administrative context and execution flags. Additionally, it identifies subsequent actions such as `taskkill` commands or `powershell` execution, which are common post-exploitation activities after successful ZeroLogon exploitation.
Page 349 of 680