SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,723 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when 'regedit.exe' is used to export a registry key to an Alternate Data Stream (ADS). This technique can be used by adversaries to hide data, such as exported registry keys, within existing files to evade detection. The rule specifically looks for the execution of 'regedit.exe' which is a legitimate Windows utility, making the detection focused on its suspicious usage in conjunction with ADS.
Detects the creation of temporary files associated with Advanced IP Scanner, a tool often used by ransomware groups for network discovery. This rule specifically looks for the creation of files within the user's temporary directory that contain the string '\AppData\Local\Temp\Advanced IP Scanner 2'.
Detects svchost.exe initiating an outbound network connection on TCP port 3389 (RDP) to a loopback address (127.0.0.0/8 or ::1/128). This behavior is indicative of RDP traffic being tunneled, potentially via a reverse SSH tunnel, to bypass network restrictions or for covert remote access.
This rule detects the use of `System.IdentityModel.Tokens.KerberosRequestorSecurityToken` within PowerShell script blocks. This specific class is used to request Kerberos service tickets (TGS) for a given Service Principal Name (SPN). This behavior is commonly observed in Kerberoasting attacks (T1558.003) where an attacker requests service tickets to crack their hashes offline, or in some cases, during the initial stages of a silver ticket attack (T1558.002) to gather SPNs. A successful execution of such a script would typically output the SPNs for the targeted endpoint.
Detects PowerShell scripts that contain references to the .NET `[System.Windows.Input.Keyboard]::IsKeyDown` function, which can be used for keystroke capturing. This function checks if a specified key is pressed, making it a common indicator of potential keylogger activity within PowerShell scripts.
This rule detects potential password spraying attempts that leverage the built-in Windows utility `dsacls.exe`. Specifically, it looks for executions of `dsacls.exe` where the command line includes both the `/user:` and `/passwd:` arguments, indicating an attempt to bind to an LDAP session with specified credentials. This technique can be used by attackers to test a single password against multiple user accounts to avoid account lockouts.
Detects potential process patterns related to Cobalt Strike beacon activity. This includes specific command-line executions like 'whoami' from the C:\Temp\ directory, or 'cmd.exe /c echo' piping output to a named pipe when the parent process is 'runonce.exe' or 'dllhost.exe'. It also identifies 'conhost.exe' being spawned with particular arguments in conjunction with these suspicious parent command lines.
Detects suspicious child processes spawned by common Windows shell and scripting processes such as mshta.exe, powershell.exe, rundll32.exe, cscript.exe, wscript.exe, wmiprvse.exe, and regsvr32.exe. The suspicious child processes include schtasks.exe, nslookup.exe, certutil.exe, bitsadmin.exe, and mshta.exe, which are often abused for various malicious activities like persistence, data exfiltration, or further execution.
This rule detects the execution of 'csc.exe' as a sub-process of 'WINWORD.EXE'. This specific process relationship is indicative of exploitation attempts leveraging CVE-2017-8759, where a crafted document (opened by Winword) can lead to the execution of arbitrary code, often using csc.exe (C# compiler) to compile and execute malicious code on the fly.
Detects command-line indicators associated with the APT29 (Cozy Bear) 2018 phishing campaign, specifically looking for PowerShell execution with '-noni -ep bypass' and the presence of 'cyzfc.dat' and 'PointFunctionCall' in the command line. These indicators are linked to the group's methods for executing malicious code and potentially bypassing security measures.
Page 426 of 680