SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,757 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of a remote thread by a PowerShell process (powershell.exe or pwsh.exe) into specific target processes, namely rundll32.exe or regsvr32.exe. This activity is often indicative of defense evasion and execution techniques used by adversaries to inject malicious code or achieve persistence by leveraging legitimate system binaries.
This rule detects the execution of `find.exe` or `findstr.exe` on Windows systems when used to search for keywords commonly associated with security tools. Attackers often use these utilities to discover installed security software by piping the output of other reconnaissance commands (like `tasklist` or `whoami`) through `findstr` to filter for specific terms. The rule specifically looks for command-line arguments containing keywords such as "avira", "cb", "cylance", "defender", "kaspersky", "kes", "mc", "sec", "sentinel", "symantec", and "virus", including variations with double quotes.
Detects the usage of 'Squirrel.exe' or 'Update.exe' to download arbitrary files. These binaries are often part of Electron-based software installations (e.g., Slack, Teams, Discord) and can be abused for proxy execution and file download, leveraging their trusted status.
Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE. The downloaded files are temporarily stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>". This technique can be used for defense evasion and execution.
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
Detects whether a process is created from an image path that does not have a standard executable file extension (e.g., .exe, .com, .bin). This behavior can indicate advanced evasion techniques like process ghosting or other unorthodox methods to launch processes, where an executable might be disguised or loaded without a typical extension. The rule includes various filters to reduce false positives from legitimate system processes, temporary files, installer components, and specific third-party applications.
Detects the execution of "whoami.exe" with the "/FO CSV" flag to choose CSV as output format or with redirection options (e.g., `whoami > file.txt`) to export the results to a file for later use. This activity is often observed in post-exploitation discovery phases by adversaries to gather information about the current user.
Detects the usage of `findstr.exe` in combination with keywords like "Everyone" or "BUILTIN" to identify potentially misconfigured file or folder permissions. This activity is often seen during reconnaissance phases by adversaries looking for privilege escalation opportunities.
Detects PowerShell commands that decrypt an ".LNK" file to drop the next stage of the malware. The rule specifically looks for PowerShell execution combined with command-line arguments indicative of file system enumeration (Get-ChildItem, dir, gci, ls), file content retrieval (Get-Content, gc, cat, type, ReadAllBytes), and specific patterns involving ".lnk" files, recursion, skipping bytes, expanding properties, and writing all bytes, suggesting decryption and dropping of subsequent malware stages.
This rule detects potentially suspicious command-line arguments used with Electron-based applications such as Microsoft Teams, Discord, Slack, Microsoft Edge, and VS Code. The presence of specific command-line switches like '--browser-subprocess-path', '--gpu-launcher', '--renderer-cmd-prefix', or '--utility-cmd-prefix' in conjunction with these applications could indicate an attempt to abuse these signed binaries for proxy execution of malicious code, potentially bypassing security controls.
Page 392 of 680