SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,760 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of the `CreateMiniDump.exe` utility or a process with a specific import hash associated with `CreateMiniDump`, which is used to dump the LSASS process memory for credential extraction. This tool is often used by attackers to bypass antivirus signatures that might detect `mimikatz` or similar tools.
Detects the execution of HandleKatz, a tool designed to dump LSASS memory using cloned handles. The rule identifies the tool by its executable name ('loader.exe'), specific command-line arguments including '--pid:', '--outfile:', and keywords like '.dmp', 'lsass', '.obf', or 'dump', and known IMPHASH values associated with HandleKatz.
Detects potential SquiblyTwo attack technique where WMIC is used to execute remote XSL files. This rule specifically looks for WMIC execution with command-line arguments indicating a format specifier and an HTTP URL, combined with checks for the original WMIC executable name or known WMIC ImpHashes, even if the binary is renamed.
Detects the execution of the GMER tool, a rootkit detector and remover, based on its executable name and known file hashes. This tool can be used by adversaries to impair defenses by identifying and disabling security software or hidden processes.
Detects the execution of the LocalPotato Proof-of-Concept (POC) tool. This detection is based on specific characteristics of the executable's image name, command-line arguments, and known import hashes (IMPHASH) associated with LocalPotato. The tool is known for exploiting vulnerabilities to achieve privilege escalation.
This rule detects the execution of the IOX tunneling tool, which is used for port forwarding and intranet proxy purposes. It specifically looks for the executable name 'iox.exe' and common command-line arguments associated with its forwarding and proxy functionalities, such as '.exe fwd -l', '.exe fwd -r', '.exe proxy -l', and '.exe proxy -r'. Additionally, it includes specific MD5, SHA1, and SHA256 hashes for version 0.4 of the tool to enhance detection accuracy.
Detects the execution of 'nimgrab.exe', a tool often bundled with the Nim programming framework and used for downloading files. This activity can indicate an adversary transferring tools or other files into a compromised environment.
Detects the execution of 'npc.exe', the client component of NPS (a port forwarding and intranet penetration proxy server). Detection is based on the executable name, specific command-line arguments indicative of server connection and authentication, or known hashes of the 'npc.exe' client.
Detects the execution of 'client32.exe', a component of the NetSupport Remote Control tool, when it is launched from an unusual directory outside of the standard 'C:\Program Files' or 'C:\Program Files (x86)' paths. This behavior can indicate an adversary attempting to evade detection by placing legitimate remote access tools in non-standard locations.
Detects the execution of a Proof-of-Concept (PoC) tool named 'SysmonEOP.exe' or a variant identified by specific IMPHASH values. This tool is designed to exploit CVE-2022-41120, a vulnerability in Sysmon that can lead to privilege escalation.
Page 380 of 680