SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,760 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of 'dotnet-trace.exe' with command-line arguments indicative of proxy execution, specifically when it's used to collect traces for another process. This technique can be abused by adversaries to bypass defenses by leveraging a trusted Microsoft-signed binary to execute malicious code or actions.
Detects process execution from a fake recycle bin folder, which is a common technique used by adversaries to evade security solutions and hide malicious executables. The rule specifically looks for process images (executables) located within paths containing 'RECYCLERS.BIN\' or 'RECYCLER.BIN\'.
Detects changes to the PowerShell execution policy in the Windows Registry to bypass signing requirements for script execution. This rule specifically looks for modifications to the 'ExecutionPolicy' registry values under PowerShell-related paths, setting them to 'Bypass' or 'Unrestricted'. It also filters out changes made by 'svchost' to reduce false positives.
Detects suspicious DNS queries to Monero mining pools
This rule detects network connections initiated by executables (excluding common internet browsers and known applications) to a list of legitimate, popular websites that have been previously identified as 'dead drop resolvers' in cyberattacks. Attackers leverage these trusted websites (e.g., Facebook, YouTube, Google Drive) to host C2 infrastructure or relay data, aiming to blend in with normal network traffic and evade detection. The rule specifically filters out connections from a comprehensive list of legitimate browser executables and other applications to reduce false positives.
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains. This behavior can indicate data exfiltration or the staging of malicious tools.
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.
Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.
Detects potential calls to NtOpenProcess directly from NTDLL.
Page 387 of 680