SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,735 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the use of the Deployment Image Servicing and Management (DISM) tool, specifically 'Dism.exe' or 'DismHost.exe', with command-line arguments indicating an attempt to disable features or remove packages from a running Windows operating system ('/Online' and '/Disable-Feature'). This activity can be indicative of an adversary trying to impair defenses by disabling security features or removing security-related components.
Detects the modification of the 'AllowAnonymousCallback' registry value to '1' (0x00000001) within the WMI CIMOM path. This registry setting enables remote connections between computers that do not have a trust relationship, which can be abused by attackers for lateral movement or remote execution without proper authentication. This modification can indicate an attempt to weaken security controls related to WMI remote access.
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
This rule detects attempts to use obfuscated or encoded IP addresses (e.g., hexadecimal, octal, or URL-encoded formats) within command-line arguments of `ping.exe` or `arp.exe`. This technique can be used by adversaries to evade simple string-based detections or to obscure their network communication targets.
Detects when the CertOC.exe utility is used to download a file from an IP address-based URL. This behavior is suspicious as CertOC.exe is a legitimate Windows binary that can be abused for ingress tool transfer, and downloading from an IP address directly often bypasses DNS-based security controls and can indicate malicious activity.
Detects the execution of a Microsoft Office application (Excel, PowerPoint, Word) that attempts to open a document located in a trusted Microsoft Office location. Attackers often leverage this technique to bypass macro security warnings and execute malicious code, as documents in trusted locations may not trigger security prompts. The rule specifically looks for parent processes like explorer.exe or dopus.exe launching these Office applications with command-line arguments pointing to documents within known trusted paths such as AppData\Roaming\Microsoft\Templates or Microsoft Office\root\Templates. It filters out common template file extensions (.dotx, .xltx, .potx) to reduce false positives.
This rule detects the execution of a binary that has been renamed from its original 'CURL.exe' name. It identifies this by checking the 'OriginalFileName' and 'Description' fields within the executable's PE metadata. The rule specifically triggers if these fields indicate 'curl.exe' or 'The curl executable', but the actual image path does not contain '\curl', suggesting an attempt to evade detection by renaming the legitimate curl utility.
Detects the creation of a named pipe with the pattern '\coerced\' which is indicative of the hack tool CoercedPotato. This tool is used for privilege escalation by coercing authentication from a target system.
This rule detects PowerShell scripts that attempt to discover security software installed on a system. Specifically, it looks for the use of 'Get-Process' (or its alias 'gps') piped to 'Where-Object' (or its alias '?') to filter processes based on keywords commonly associated with security products such as 'avira', 'carbonblack', 'cylance', 'defender', 'kaspersky', 'malware', 'sentinel', 'symantec', and 'virus'. The filtering can be applied to process properties like Company, Description, Name, Path, or Product. This activity is indicative of an adversary attempting to enumerate defensive tools present on the system.
This rule detects the use of 'curl.exe' to download files from an IP address directly specified in the command line. It specifically looks for curl.exe execution, a command line containing an IP address pattern, the 'http' protocol, and common download flags such as '-O', '--remote-name', or '--output'. This activity is often associated with adversaries transferring tools or malware onto a compromised system.
Page 400 of 680