SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,764 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects modifications to shell context menu commands within the Windows Registry. This rule is designed to identify potential persistence mechanisms or suspicious activity where an attacker might alter the commands executed when a user interacts with files or folders via the right-click context menu. The detection specifically looks for changes in registry paths containing '\Software\Classes\', '\shell\', and '\command\', which are indicative of context menu command definitions.
Detects remote binary or command execution via the ScreenConnect Service. This rule is intended for hunting anomalous executions originating from ScreenConnect, which is a legitimate remote administration tool that can be abused by threat actors.
Detects the execution of the Evil-WinRM hack tool by identifying specific hardcoded strings within PowerShell Module logs. This rule looks for patterns associated with Evil-WinRM's functionality, such as specific PowerShell commands for file operations, binary invocation, and registry queries, executed within the context of wsmprovhost.exe.
Detects DNS queries for specific command and control (C2) domains known to be used by DPRK (Democratic People's Republic of Korea) threat actors. The rule specifically looks for 'connection.lockscreen.kro.kr' and 'updating.dothome.co.kr' in DNS query names.
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects suspicious modifications to the SentinelOne context menu scan command in the Windows Registry. This rule specifically looks for changes made by processes other than the legitimate SentinelOne agent, indicating potential tampering or persistence mechanisms.
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behavior is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects the execution of a system command, specifically 'cmd.exe', initiated by the ScreenConnect remote management service. This rule looks for 'cmd.exe' being spawned as a child process of 'ScreenConnect.ClientService.exe' and further refines the detection by looking for command lines that include the pattern '\TEMP\ScreenConnect\', which is indicative of temporary script execution by ScreenConnect.
Detects potential web shell execution originating from the ScreenConnect server process. This rule specifically looks for the ScreenConnect.Service.exe spawning cmd.exe or csc.exe, which could indicate an attacker leveraging a compromised ScreenConnect server to execute arbitrary commands or compile code.
Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe. This rule looks for executions of 'wget.exe' where the command line includes an IP address, 'http', and specific suspicious paths often used for temporary files or public user directories. This could indicate an adversary downloading malicious tools or files directly to a system.
Page 370 of 680