SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,774 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when a Python process initiates an outbound network connection. While this activity can be legitimate for tasks like package installation or updates, it can also be indicative of malicious behavior, such as a Python-based script establishing communication with a command and control (C2) server or performing network reconnaissance. The rule includes filters to reduce false positives from common activities like Anaconda updates, Jupyter Notebook local communication, and 'pip install' commands.
Detects programs that connect to known malware callback ports based on threat intelligence reports.
Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil".
An attacker can use this to prevent backups from occurring.
An attacker can use this to prevent backups from occurring.
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
This rule detects suspicious parent processes for a set of well-known Windows system processes. It specifically looks for instances where `svchost.exe`, `taskhost.exe`, `lsm.exe`, `lsass.exe`, `services.exe`, `lsaiso.exe`, `csrss.exe`, `wininit.exe`, or `winlogon.exe` are spawned by a parent process that is not typically expected. The rule filters out legitimate parent processes such as those from security products (e.g., `SavService.exe`, `MsMpEng.exe`), common system directories (`System32`, `SysWOW64`), and cases where the parent process is null or empty.
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from an uncommon parent location. This behavior can indicate privilege escalation or defense evasion by an attacker.
Detects the use of Windows API (WinAPI) functions being called directly via the command line. This technique is often used by threat actors, for example, with tools like winapiexec, to perform various malicious actions such as privilege escalation, process injection, or credential dumping by directly interacting with low-level operating system functions. The rule specifically looks for a wide range of sensitive WinAPI function names and DLLs in the command line arguments of newly created processes.
Detects the execution of 'whoami.exe' when its parent process is not a common legitimate shell or application, or when the parent process information is missing. This can indicate suspicious activity, as 'whoami.exe' is often used by attackers for discovery purposes.
Detects the use of the 'Get-ADComputer' cmdlet with specific parameters or LDAP filters to identify systems configured for unconstrained delegation. This activity is often performed by adversaries during the reconnaissance phase to find targets for Kerberos-based attacks like credential theft.
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity. The rule specifically looks for conhost.exe being spawned by processes other than a predefined list of common and legitimate parents, while also filtering out specific command-line patterns for svchost.exe and Dropbox to reduce false positives.
Page 354 of 680