SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,735 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.
Detects command line arguments that include '::$index_allocation', which is a technique used to create hidden directories or files within the NTFS file system. This method can prevent standard tools like 'explorer.exe' or 'powershell.exe' from accessing or listing these hidden artifacts, serving as a defense evasion tactic.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could disable these warnings to run malicious Python code within spreadsheets without user notification, leveraging the new Microsoft Excel feature that allows Python execution.
Detects the creation of files that look like exports of the local SAM (Security Account Manager)
Detects the execution of Windows binaries from within a Windows Subsystem for Linux (WSL) instance. This technique can be used by adversaries to masquerade parent-child process relationships, making it harder to detect malicious activity.
Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
Detects the execution of common macOS command-line utilities used for enumerating local network configuration and firewall settings. This includes tools like 'arp', 'ifconfig', 'netstat', 'networksetup', and 'socketfilterfw', as well as 'defaults' when querying specific firewall preferences.
Detects the execution of Microsoft Workflow Compiler (Microsoft.Workflow.Compiler.exe), which can be abused to execute arbitrary unsigned code. This utility is part of the .NET Framework and can compile and execute workflow definition files. Adversaries may leverage this for defense evasion and execution by proxying malicious code through a trusted, signed binary.
Detects the 'sdiagnhost.exe' process launching suspicious child processes, which has been observed in exploits like Follina (CVE-2022-30190). The rule specifically looks for sdiagnhost.exe as a parent process and a list of common Living Off The Land Binaries (LOLBins) or other suspicious executables as child processes. It includes filters to reduce false positives related to common command-line arguments for cmd.exe and powershell.exe.
This rule detects file activity indicative of potential exploitation of the MOVEit Transfer CVE-2023-34362 vulnerability. It specifically looks for the creation or modification of suspicious file types (like .7z, .bat, .dll, .exe, .ps1, .rar, .vbe, .vbs, .zip) within the MOVEit Transfer webroot directory. Additionally, it identifies the presence of known malicious files such as `_human2.aspx` or `human2.aspx` and their shortcut files (`.lnk`) within the same directory. The rule also includes a selection for newly compiled ASP.NET DLLs within the temporary ASP.NET files directory, created around the time the vulnerability was actively exploited (March-June 2023), which could indicate the deployment of web shells or other malicious code.
Page 401 of 680