SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,741 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects a specific command-line execution pattern used by the threat actor 'Lace Tempest' to download 'Cobalt Strike'. The pattern involves PowerShell's 'IEX ((new-object net.webclient).downloadstring(' command, which is commonly used for in-memory execution of downloaded scripts or payloads. The detection specifically looks for the combination of '-nop -w hidden -c IEX ((new-object net.webclient).downloadstring(' and '/a') in the command line, indicating an attempt to download and execute a script, likely a Cobalt Strike payload, as reported by the SysAid Team.
This rule detects when the 'RstrtMgr.dll' (Restart Manager) library is loaded by a process that is not part of the common legitimate Windows processes or typical software installation paths. Adversaries, particularly ransomware and wiper malware, have been observed using this DLL to terminate processes that might interfere with their operations, such as file encryption or data destruction. This can include killing processes that lock files, preventing encryption, or for anti-analysis purposes.
Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule looks for specific HTTP POST requests containing 'NO_BINARY_CHECK=1' and 'input.path' in the URI query, ending with '.xsl', and resulting in a 200 or 302 HTTP status code. These patterns are indicative of an attempt to leverage the insecure XML parsing vulnerability.
Detects the usage of the "Import-Module" cmdlet or its alias "ipmo" in PowerShell command lines to add new Cmdlets to the current PowerShell session. This rule aims to identify instances where modules are dynamically loaded, which can be a legitimate administrative action but also a technique used by adversaries for execution or privilege escalation.
Detects the loading of the Windows Restart Manager (RstrtMgr.dll) by a process executing from a suspicious directory. This DLL has been observed in ransomware campaigns (e.g., Conti, Cactus) and wipers (e.g., BiBi) to terminate processes that might lock files, facilitating encryption or data destruction. It could also be used for anti-analysis purposes.
Detects suspicious process access requests to the LSASS process using specific GrantedAccess flags. These flags are often associated with tools and techniques used for credential dumping, such as Mimikatz, by attempting to read or manipulate LSASS memory to extract credentials. The rule includes filters for common legitimate processes like antivirus software, EDRs, and system utilities to reduce false positives.
Detects the execution of the 'msxsl.exe' utility with an 'http' keyword in the command line, indicating a potential attempt to execute XSL files from a remote source. This technique can be used by adversaries to bypass application control and execute malicious scripts.
Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects the use of 'IMEWDBLD.exe', a legitimate Microsoft binary, to download arbitrary files from HTTP or HTTPS sources. This technique is often abused by adversaries for ingress tool transfer or to fetch additional malicious payloads, leveraging a trusted binary to bypass defenses.
Detects the modification of the 'Ime File' registry value within the 'Keyboard Layouts' key to include an uncommon file extension. This technique can be used by attackers to load a malicious DLL into a process via the Windows Input Method Editor (IME) feature, typically after sending a WM_INPUTLANGCHANGEREQUEST message. The rule specifically looks for modifications where the 'Ime File' value does not end with the standard '.ime' extension, indicating potential malicious activity.
Page 391 of 680