SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of rundll32.exe that leads to an external network connection, specifically looking for known processes used by the Pikabot malware family for command and control (C2) communication. This rule identifies suspicious network activity originating from rundll32.exe when its parent process is one of the specified Windows binaries, which Pikabot has been observed to hijack for C2.
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level, when launched from a potentially suspicious or uncommon parent process or location. This often indicates an adversary performing reconnaissance within an Active Directory environment.
Detects the execution of a binary that has been renamed from its original name, often used by attackers or malware for defense evasion. This rule leverages the Sysmon 'OriginalFileName' datapoint to identify instances where common Windows utilities or attacker tools are executed under a different filename.
Detects attempts to discover password policy information on Linux systems by monitoring access to key configuration files and the execution of 'chage' and 'passwd' commands with specific arguments.
Detects process creation activity related to the Peach Sandstorm APT, specifically looking for a unique string 'QP's\*(58vaP!tF4' in the command line. This string is likely a unique identifier or a specific parameter used by the APT's tools.
Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability. This rule specifically looks for instances where a command interpreter (cmd.exe, powershell.exe, or pwsh.exe) is spawned as a child process of the Microsoft Edge elevation service (elevation_service.exe) with SYSTEM integrity level, indicating a successful privilege escalation.
Detects the use of common Linux utilities such as 'find', 'tree', 'findmnt', 'ls -R', and 'mlocate' for discovering files, directories, and potentially network shares. This activity is often performed by adversaries to gain situational awareness of the file system.
Detects remote thread creation in the 'mstsc.exe' process by a process originating from a suspicious temporary or public user directory. This technique is often used by attackers to inject code into 'mstsc.exe' to hook APIs and steal credentials during RDP authentications.
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information. The rule specifically looks for command-line arguments related to building caches, dumping bloodhound data, certificate dumping, and DNS dumping, combined with arguments for cache filenames or output directories.
This rule detects the execution of the PingCastle utility, a legitimate Active Directory security assessment tool, when its executable name has been changed. Adversaries often rename legitimate tools to evade detection. The detection logic relies on identifying specific original file names within the PE metadata (OriginalFileName) and/or recognizing characteristic command-line arguments used by PingCastle, such as those related to scanner functions or health checks. The rule specifically filters out executions where the image path matches the original PingCastle executable names, focusing on instances where the binary has been renamed.
Page 374 of 680