SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,757 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects suspicious child processes spawned by Excel.exe, which can indicate lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object. Specifically, it looks for child processes with original filenames or image paths ending in 'foxprow.exe', 'schdplus.exe', or 'winproj.exe'. This behavior is associated with DCOM abuse for remote code execution.
Detects the usage of "msedge_proxy.exe" to download arbitrary files by looking for its execution with command-line arguments containing 'http://' or 'https://'. This behavior can be abused for defense evasion and execution.
Detects the execution of the 'whoami.exe' command by highly privileged accounts such as 'AUTHORITY\SYSTEM', 'NT AUTHORITY\SYSTEM', or 'TrustedInstaller'. This activity can indicate an attacker performing discovery after achieving privilege escalation, as these accounts are often targeted for abuse.
This rule detects the usage of the Windows Package Manager (winget.exe) to add new package sources, specifically looking for command-line arguments that include 'source add' and an IP address as the source. This could indicate an attempt to introduce a malicious or untrusted package repository.
Detects the modification of the "Ime File" registry value within the Keyboard Layouts key to point to suspicious folders. This technique can be used by attackers to load a malicious DLL into a process after sending a WM_INPUTLANGCHANGEREQUEST message, leveraging the Windows Input Method Editor (IME) feature for persistence or defense evasion. The rule specifically looks for DLL paths located in common temporary or user-writable directories, which are often abused by malware.
This rule detects the execution of various known hacktools on Linux systems by monitoring process creation events and matching against a predefined list of tool names in the 'Image' field. The tools covered include C2 frameworks (e.g., Cobalt Strike, Metasploit, Havoc, Merlin, Sliver), network scanners (e.g., Nmap derivatives, Nuclei, Recon-ng), web enumeration tools (e.g., Dirb, Ffuf, Gobuster), web vulnerability scanners (e.g., Nikto, WPSCan), and other exploit/post-exploitation tools (e.g., Aircrack-ng, Bloodhound-Python, Hashcat, Hydra, John, SQLMap, PEASS-ng).
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.
Detects when Windows Defender Real-time Protection is disabled. This event may not contain detailed information about the initiator, requiring further investigation.
This rule detects attempts to request write access to Windows Defender exclusion registry keys. This activity is highly suspicious as it could indicate an attacker attempting to modify or add new exclusions to bypass antivirus protection. The rule specifically looks for Event IDs 4656 (handle requested) or 4663 (object access attempt) in conjunction with write-related access rights (WriteData or AppendData) on registry paths containing '\Microsoft\Windows Defender\Exclusions\'.
Page 393 of 680