SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,779 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the use of various emojis within command-line arguments. Adversaries may use uncommon characters, such as emojis, in command lines to evade signature-based detections, obfuscate their activities, or bypass security controls that are not designed to parse or analyze such characters. This technique falls under defense evasion, as it attempts to make malicious commands less conspicuous to automated analysis.
Detects the usage of emojis and various Unicode characters in command-line arguments. This technique can be used by adversaries for defense evasion, specifically to obfuscate commands and avoid detection by signature-based security tools. The rule identifies a wide range of such characters, including colored squares, arrows, playing card symbols, clock faces, chess pieces, dice, hieroglyphs, flags, and modern emojis.
This rule detects the execution of binaries that are named similarly to legitimate Sysinternals tools but lack the expected digital signature or product information. Adversaries often rename their malicious tools to impersonate legitimate software like Sysinternals utilities to evade detection and appear less suspicious.
Detects the execution of obfuscated PowerShell one-liners designed to download and execute PowerShell modules in memory. This rule specifically looks for PowerShell command lines containing a URL (e.g., 'http://127.0.0.1'), the 'IRM' (Invoke-RestMethod) alias within a loop ('%{(IRM $_)}'), and the 'Invoke' keyword, which are indicative of in-memory module execution.
This rule detects the presence of specific emoji characters within the command line arguments of a newly created process. The use of emojis in command lines is highly unusual and could indicate an attempt by an adversary to evade detection by security tools that may not be configured to parse or analyze non-standard characters, or to obfuscate malicious commands. The rule specifically targets a wide range of human-like and animal emojis with various skin tones.
Detects the execution of WMIC to enumerate installed firewall, antivirus, and antispyware products. Adversaries often perform this discovery to understand security controls, plan evasion tactics, or disable protection mechanisms.
Detects when an attacker attempts to disable User Account Control (UAC) notifications by modifying the "UACDisableNotify" registry value. UAC is a critical Windows security feature that prompts users for permission or an administrator password before allowing actions that could affect system operation or change settings. Setting "UACDisableNotify" to 1 suppresses these UAC prompts, which can be leveraged by attackers for privilege escalation or defense evasion.
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky. The rule specifically looks for Qemu command-line arguments indicative of network tunneling or proxying, such as low memory allocation ('-m 1M', '-m 2M', '-m 3M'), network device configuration ('-netdev', 'connect='), and running without a graphical interface ('-nographic'), while filtering out common legitimate use cases like CD-ROM or virtual block device usage.
Page 352 of 680