SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects system discovery activity carried out by Pikabot, such as network, user information, and domain groups. The malware Pikabot has been observed using this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute). The rule specifically looks for `ipconfig.exe /all`, `netstat.exe -aon`, and `whoami.exe /all` commands executed by processes whose grandparent image ends with `rundll32.exe` or parent image ends with `SearchFilterHost.exe` or `SearchProtocolHost.exe`.
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS, and GPU driver products/versions. This activity is often performed by adversaries during the discovery phase to understand the compromised environment.
This rule detects a specific User Account Control (UAC) bypass technique often associated with UACMe (specifically method 22). It triggers when 'werfault.exe' is spawned with high or system integrity levels, and its parent process is 'consent.exe'. This indicates an attempt to elevate privileges by exploiting a vulnerability in how consent.exe handles process creation, leading to an auto-elevated werfault.exe.
Detects potential Command and Control (C2) communication activity associated with the Peach Sandstorm APT group. The rule specifically looks for HTTP GET requests to '/api/Core/Command/Init' or '/api/Core/Command/Restart' endpoints, which are indicators of this group's C2 infrastructure.
Detects a CodePage modification using the "mode.com" utility. This behavior has been used by threat actors behind Dharma ransomware.
This rule detects a specific User Account Control (UAC) bypass technique that leverages the Disk Cleanup utility (cleanmgr.exe) in conjunction with scheduled tasks. The detection logic looks for a process creation event where 'cleanmgr.exe' is executed with the '/autoclean /d C:' arguments, and its parent process is 'svchost.exe -k netsvcs -p -s Schedule', indicating it was launched by the Task Scheduler service. Furthermore, the rule specifies that the integrity level of the 'cleanmgr.exe' process must be 'High' or 'System', which is indicative of an elevated process, thus confirming a successful UAC bypass. This technique is associated with UACMe method 34.
This rule detects attempts to bypass User Account Control (UAC) using the Microsoft Connection Manager Profile Installer (CMSTP) by abusing specific autoelevate-capable COM objects. The detection logic looks for processes where 'DllHost.exe' is the parent process, the parent command line contains specific COM Process IDs associated with CMSTP or related components, and the process is running with 'High' or 'System' integrity levels. This technique is often used by adversaries to elevate privileges without user interaction.
Detects the execution of 'wsreset.exe' with elevated privileges (High or System integrity levels). This behavior is indicative of a User Account Control (UAC) bypass attempt, as 'wsreset.exe' is a legitimate Windows utility that can be abused to elevate privileges without a UAC prompt.
Detects the "iexpress.exe" utility creating self-extracting packages. Attackers are known to leverage "iexpress" to compile packages on the fly via ".sed" files. This rule specifically looks for iexpress.exe either launching makecab.exe or iexpress.exe itself being launched with the '/n' command line argument, which is indicative of creating a new self-extracting package.
Detects when all rules have been deleted from the Windows Defender Firewall configuration. This action can be performed by an attacker to bypass network controls and facilitate command and control, lateral movement, or data exfiltration.
Page 375 of 680